Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-42499 (GCVE-0-2026-42499)
Vulnerability from cvelistv5 – Published: 2026-05-07 19:41 – Updated: 2026-08-20 12:32
VLAI
EPSS
VEX
Title
Quadratic string concatenation in consumePhrase in net/mail
Summary
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-08 16:55 UTC
CWE
Assigner
References
46 references
Impacted products
106 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Go standard library | net/mail |
Affected:
0 , < 1.25.10
(semver)
Affected: 1.26.0-0 , < 1.26.3 (semver) |
guessed | |
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
0:1.32.13-9.rhaos4.19.git2100f27.el9 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el8 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
0:4.19.0-202608111604.p2.g63adf01.assembly.stream.el9 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el8 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
0:4.19.0-202608111604.p2.gb2a93a6.assembly.stream.el8 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el8 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
0:4.19.0-202608111604.p2.g425c1c5.assembly.stream.el9 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el8 |
||
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 |
Unaffected:
1786613805 , < *
(rpm)
cpe:/a:redhat:cert_manager:1.19::el9 |
||
| Red Hat | Logging for Red Hat OpenShift 6.4 |
Unaffected:
1782405469 , < *
(rpm)
cpe:/a:redhat:logging:6.4::el9 |
||
| Red Hat | Logging Subsystem for Red Hat OpenShift 6 |
Unaffected:
1785419067 , < *
(rpm)
cpe:/a:redhat:logging:6.0::el9 |
||
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.2 |
Unaffected:
1784748010 , < *
(rpm)
cpe:/a:redhat:logging:6.2::el9 |
||
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.5 |
Unaffected:
1786645248 , < *
(rpm)
cpe:/a:redhat:logging:6.5::el9 |
||
| Red Hat | OpenShift API for Data Protection 1.3 |
Unaffected:
1785177357 , < *
(rpm)
cpe:/a:redhat:openshift_api_data_protection:1.3::el9 |
||
| Red Hat | OpenShift API for Data Protection 1.6 |
Unaffected:
1784058822 , < *
(rpm)
cpe:/a:redhat:openshift_api_data_protection:1.6::el9 |
||
| Red Hat | Red Hat Advanced Cluster Security 4.9 |
Unaffected:
1783357116 , < *
(rpm)
cpe:/a:redhat:advanced_cluster_security:4.9::el8 |
||
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 |
Unaffected:
1783357140 , < *
(rpm)
cpe:/a:redhat:advanced_cluster_security:4.10::el8 |
||
| Red Hat | Red Hat Developer Hub 1.10 |
Unaffected:
1783447707 , < *
(rpm)
cpe:/a:redhat:rhdh:1.10::el9 |
||
| Red Hat | Red Hat Developer Hub 1.9 |
Unaffected:
1782767215 , < *
(rpm)
cpe:/a:redhat:rhdh:1.9::el9 |
||
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.25.10-2.2.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
||
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.26.3-2.2.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
||
| Red Hat | Red Hat Migration Toolkit 1.8 |
Unaffected:
1783953372 , < *
(rpm)
cpe:/a:redhat:rhmt:1.8::el8 |
||
| Red Hat | Red Hat Migration Toolkit for Applications 8.1 |
Unaffected:
1785171639 , < *
(rpm)
cpe:/a:redhat:migration_toolkit_applications:8.1::el9 |
||
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 |
Unaffected:
1784211378 , < *
(rpm)
cpe:/a:redhat:migration_toolkit_applications:8.2::el9 |
||
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783544461 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
1786489910 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.20 |
Unaffected:
1786494900 , < *
(rpm)
cpe:/a:redhat:openshift:4.20::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.21 |
Unaffected:
1786496647 , < *
(rpm)
cpe:/a:redhat:openshift:4.21::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.21 |
Unaffected:
1786573075 , < *
(rpm)
cpe:/a:redhat:openshift:4.21::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
Unaffected:
1782222217 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.0::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
Unaffected:
1782223341 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.0::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
Unaffected:
1782296193 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.0::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
Unaffected:
1782222607 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.0::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
Unaffected:
1782222163 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.1::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
Unaffected:
1782223138 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.1::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
Unaffected:
1782222394 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.1::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
Unaffected:
1782222451 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.1::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
Unaffected:
1782226178 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.2::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
Unaffected:
1782224487 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.2::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
Unaffected:
1782303211 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.2::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
Unaffected:
1782224541 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.2::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
Unaffected:
1782223045 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.3::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
Unaffected:
1782222366 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.3::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
Unaffected:
1782310747 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.3::el9 |
||
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
Unaffected:
1782222038 , < *
(rpm)
cpe:/a:redhat:service_mesh:3.3::el9 |
||
| Red Hat | Red Hat OpenShift Workload Availability 0.12 |
Unaffected:
1785202723 , < *
(rpm)
cpe:/a:redhat:workload_availability_nhc:0.12::el9 |
||
| Red Hat | Red Hat OpenShift Workload Availability 0.13 |
Unaffected:
1785203036 , < *
(rpm)
cpe:/a:redhat:workload_availability_snr:0.13::el9 |
||
| Red Hat | Red Hat OpenShift Workload Availability 0.3 |
Unaffected:
1785203474 , < *
(rpm)
cpe:/a:redhat:workload_availability_sbr:0.3::el9 |
||
| Red Hat | Red Hat OpenShift Workload Availability 0.7 |
Unaffected:
1785203508 , < *
(rpm)
cpe:/a:redhat:workload_availability_mdr:0.7::el9 |
||
| Red Hat | Red Hat OpenShift Workload Availability 0.8 |
Unaffected:
1785203079 , < *
(rpm)
cpe:/a:redhat:workload_availability_far:0.8::el9 |
||
| Red Hat | Red Hat OpenShift Workload Availability 5.7 |
Unaffected:
1785202847 , < *
(rpm)
cpe:/a:redhat:workload_availability_nmo:5.7::el9 |
||
| Red Hat | Red Hat Quay 3.1 |
Unaffected:
1783750447 , < *
(rpm)
cpe:/a:redhat:quay:3.10::el8 |
||
| Red Hat | Red Hat Quay 3.12 |
Unaffected:
1783751865 , < *
(rpm)
Unaffected: 1784353904 , < * (rpm) cpe:/a:redhat:quay:3.12::el8 |
||
| Red Hat | Red Hat Quay 3.15 |
Unaffected:
1784351966 , < *
(rpm)
cpe:/a:redhat:quay:3.15::el8 |
||
| Red Hat | Red Hat Quay 3.16 |
Unaffected:
1783955846 , < *
(rpm)
cpe:/a:redhat:quay:3.16::el9 |
||
| Red Hat | Red Hat Quay 3.9 |
Unaffected:
1784125838 , < *
(rpm)
cpe:/a:redhat:quay:3.9::el8 |
||
| Red Hat | Red Hat Trusted Artifact Signer 1.4 |
Unaffected:
4-1.4.2 , < *
(rpm)
Unaffected: 4-1.4.3 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9 |
||
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 |
cpe:/a:redhat:assisted_installer:2
|
||
| Red Hat | Confidential Compute Attestation |
cpe:/a:redhat:confidential_compute_attestation:1
|
||
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4
|
||
| Red Hat | Custom Metric Autoscaler operator for Red Hat Openshift |
cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
|
||
| Red Hat | External Secrets Operator for Red Hat OpenShift |
cpe:/a:redhat:external_secrets_operator:1
|
||
| Red Hat | File Integrity Operator |
cpe:/a:redhat:openshift_file_integrity_operator:1
|
||
| Red Hat | Gatekeeper 3 |
cpe:/a:redhat:gatekeeper:3
|
||
| Red Hat | Logical Volume Manager Storage |
cpe:/a:redhat:lvms:4
|
||
| Red Hat | Multiarch Tuning Operator |
cpe:/a:redhat:multiarch_tuning_operator
|
||
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine
|
||
| Red Hat | Multicluster Global Hub |
cpe:/a:redhat:multicluster_globalhub
|
||
| Red Hat | Network Observability Operator |
cpe:/a:redhat:network_observ_optr:1
|
||
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools
|
||
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed
|
||
| Red Hat | OpenShift Pipelines |
cpe:/a:redhat:openshift_pipelines:1
|
||
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1
|
||
| Red Hat | OpenShift Service Mesh 2 |
cpe:/a:redhat:service_mesh:2
|
||
| Red Hat | OpenShift Service Mesh 3 |
cpe:/a:redhat:service_mesh:3
|
||
| Red Hat | Power monitoring for Red Hat OpenShift |
cpe:/a:redhat:openshift_power_monitoring
|
||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 |
cpe:/a:redhat:acm:2
|
||
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2
|
||
| Red Hat | Red Hat Ceph Storage 5 |
cpe:/a:redhat:ceph_storage:5
|
||
| Red Hat | Red Hat Ceph Storage 6 |
cpe:/a:redhat:ceph_storage:6
|
||
| Red Hat | Red Hat Ceph Storage 9 |
cpe:/a:redhat:ceph_storage:9
|
||
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 |
cpe:/a:redhat:certifications:9
|
||
| Red Hat | Red Hat Edge Manager 1 |
cpe:/a:redhat:edge_manager:1
|
||
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
||
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
||
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3
|
||
| Red Hat | Red Hat Lightspeed for Runtimes Operator |
cpe:/a:redhat:lightspeed_for_runtimes:1
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat OpenShift Cluster Manager CLI |
cpe:/a:redhat:openshift_cluster_manager_cli:1
|
||
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
||
| Red Hat | Red Hat Openshift Data Foundation 4 |
cpe:/a:redhat:openshift_data_foundation:4
|
||
| Red Hat | Red Hat OpenShift Dev Spaces |
cpe:/a:redhat:openshift_devspaces:3
|
||
| Red Hat | Red Hat OpenShift Dev Workspaces Operator |
cpe:/a:redhat:devworkspace
|
||
| Red Hat | Red Hat OpenShift distributed tracing 3 |
cpe:/a:redhat:openshift_distributed_tracing:3
|
||
| Red Hat | Red Hat OpenShift for Windows Containers |
cpe:/a:redhat:windows_machine_config
|
||
| Red Hat | Red Hat OpenShift GitOps |
cpe:/a:redhat:openshift_gitops:1
|
||
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4
|
||
| Red Hat | Red Hat OpenStack Platform 16.2 |
cpe:/a:redhat:openstack:16.2
|
||
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1
|
||
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0
|
||
| Red Hat | Red Hat Quay 3 |
cpe:/a:redhat:quay:3
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Service Interconnect 1 |
cpe:/a:redhat:service_interconnect:1
|
||
| Red Hat | Red Hat Service Interconnect 2 |
cpe:/a:redhat:service_interconnect:2
|
||
| Red Hat | Red Hat Trusted Artifact Signer |
cpe:/a:redhat:trusted_artifact_signer:1
|
||
| Red Hat | Security Profiles Operator |
cpe:/a:redhat:openshift_security_profiles_operator:1
|
||
| Red Hat | Zero Trust Workload Identity Manager |
cpe:/a:redhat:zero_trust_workload_identity_manager:1
|
||
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview |
cpe:/a:redhat:zero_trust_workload_identity_manager:0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42499",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-08T16:55:28.873015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T21:29:59.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el8"
],
"defaultStatus": "affected",
"packageName": "cri-o",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.32.13-9.rhaos4.19.git2100f27.el9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el8"
],
"defaultStatus": "affected",
"packageName": "openshift",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.19.0-202608111604.p2.g63adf01.assembly.stream.el9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el8"
],
"defaultStatus": "affected",
"packageName": "openshift-clients",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.19.0-202608111604.p2.gb2a93a6.assembly.stream.el8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el8"
],
"defaultStatus": "affected",
"packageName": "ose-aws-ecr-image-credential-provider",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.19.0-202608111604.p2.g425c1c5.assembly.stream.el9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cert_manager:1.19::el9"
],
"defaultStatus": "affected",
"packageName": "cert-manager/jetstack-cert-manager-rhel9",
"product": "Cert Manager support for Red Hat OpenShift release 1.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786613805",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6.4::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/logging-loki-rhel9",
"product": "Logging for Red Hat OpenShift 6.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782405469",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/logging-loki-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift 6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785419067",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/logging-loki-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift 6.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784748010",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6.5::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/logging-loki-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift 6.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786645248",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.3::el9"
],
"defaultStatus": "affected",
"packageName": "oadp/oadp-velero-plugin-rhel9",
"product": "OpenShift API for Data Protection 1.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785177357",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.6::el9"
],
"defaultStatus": "affected",
"packageName": "oadp/oadp-velero-rhel9",
"product": "OpenShift API for Data Protection 1.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784058822",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.9::el8"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-main-rhel8",
"product": "Red Hat Advanced Cluster Security 4.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783357116",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.10::el8"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-main-rhel8",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783357140",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhdh:1.10::el9"
],
"defaultStatus": "affected",
"packageName": "rhdh/rhdh-rhel9-operator",
"product": "Red Hat Developer Hub 1.10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783447707",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"defaultStatus": "affected",
"packageName": "rhdh/rhdh-rhel9-operator",
"product": "Red Hat Developer Hub 1.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782767215",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "golang1-25-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.25.10-2.2.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "golang1-26-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.26.3-2.2.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhmt:1.8::el8"
],
"defaultStatus": "affected",
"packageName": "rhmtc/openshift-migration-controller-rhel8",
"product": "Red Hat Migration Toolkit 1.8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783953372",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "mta/mta-cli-rhel9",
"product": "Red Hat Migration Toolkit for Applications 8.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785171639",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8.2::el9"
],
"defaultStatus": "affected",
"packageName": "mta/mta-cli-rhel9",
"product": "Red Hat Migration Toolkit for Applications 8.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784211378",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kueue-controller-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783544461",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-cli-rhel9",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786489910",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-cli-rhel9",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786494900",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-cli-rhel9",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786496647",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-hypershift-rhel9",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786573075",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-cni-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782222217",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-pilot-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782223341",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782296193",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-rhel9-operator",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782222607",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-cni-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782222163",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-pilot-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782223138",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782222394",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-rhel9-operator",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782222451",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-cni-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782226178",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-pilot-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782224487",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782303211",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-rhel9-operator",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782224541",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-cni-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782223045",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-pilot-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782222366",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782310747",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/istio-rhel9-operator",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782222038",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:workload_availability_nhc:0.12::el9"
],
"defaultStatus": "affected",
"packageName": "workload-availability/node-healthcheck-rhel9-operator",
"product": "Red Hat OpenShift Workload Availability 0.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785202723",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:workload_availability_snr:0.13::el9"
],
"defaultStatus": "affected",
"packageName": "workload-availability/self-node-remediation-rhel9-operator",
"product": "Red Hat OpenShift Workload Availability 0.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785203036",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:workload_availability_sbr:0.3::el9"
],
"defaultStatus": "affected",
"packageName": "workload-availability/storage-based-remediation-rhel9-operator",
"product": "Red Hat OpenShift Workload Availability 0.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785203474",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:workload_availability_mdr:0.7::el9"
],
"defaultStatus": "affected",
"packageName": "workload-availability/machine-deletion-remediation-rhel9-operator",
"product": "Red Hat OpenShift Workload Availability 0.7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785203508",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:workload_availability_far:0.8::el9"
],
"defaultStatus": "affected",
"packageName": "workload-availability/fence-agents-remediation-rhel9-operator",
"product": "Red Hat OpenShift Workload Availability 0.8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785203079",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:workload_availability_nmo:5.7::el9"
],
"defaultStatus": "affected",
"packageName": "workload-availability/node-maintenance-rhel9-operator",
"product": "Red Hat OpenShift Workload Availability 5.7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785202847",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783750447",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783751865",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "1784353904",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784351966",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783955846",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784125838",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "conforma-cli-stack-v1",
"product": "Red Hat Trusted Artifact Signer 1.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4-1.4.2",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "4-1.4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:assisted_installer:2"
],
"defaultStatus": "affected",
"packageName": "rhai/assisted-installer-rhel9",
"product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"packageName": "build-of-trustee/trustee-rhel9-operator",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"packageName": "confidential-compute-attestation-tech-preview/trustee-rhel9-operator",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"packageName": "openshift-sandboxed-containers/osc-monitor-rhel9",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-storage-rhel9",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
],
"defaultStatus": "unaffected",
"packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
"product": "Custom Metric Autoscaler operator for Red Hat Openshift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "affected",
"packageName": "external-secrets-operator/external-secrets-rhel9",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_file_integrity_operator:1"
],
"defaultStatus": "affected",
"packageName": "compliance/openshift-compliance-operator-bundle",
"product": "File Integrity Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:gatekeeper:3"
],
"defaultStatus": "unknown",
"packageName": "gatekeeper/gatekeeper-rhel9-operator",
"product": "Gatekeeper 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "affected",
"packageName": "lvms4/lvms-rhel9-operator",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "unaffected",
"packageName": "lvms4/topolvm-rhel8",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "unaffected",
"packageName": "lvms4/topolvm-rhel9",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multiarch_tuning_operator"
],
"defaultStatus": "affected",
"packageName": "multiarch-tuning/multiarch-tuning-rhel9-operator",
"product": "Multiarch Tuning Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/addon-manager-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/assisted-installer-rhel8",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/assisted-installer-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/backplane-rhel9-operator",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/clusterlifecycle-state-metrics-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/discovery-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/maestro-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/multicloud-manager-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/placement-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/registration-operator-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unknown",
"packageName": "multicluster-engine/work-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub"
],
"defaultStatus": "unknown",
"packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel8",
"product": "Multicluster Global Hub",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub"
],
"defaultStatus": "unknown",
"packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
"product": "Multicluster Global Hub",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1"
],
"defaultStatus": "unaffected",
"packageName": "network-observability/network-observability-rhel9-operator",
"product": "Network Observability Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "helm",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"packageName": "openshift-pipelines-client",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "kn-workflow-plugin",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:2"
],
"defaultStatus": "unaffected",
"packageName": "openshift-golang-builder-container",
"product": "OpenShift Service Mesh 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:2"
],
"defaultStatus": "affected",
"packageName": "openshift-service-mesh/pilot-rhel8",
"product": "OpenShift Service Mesh 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "affected",
"packageName": "openshift-golang-builder-container",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_power_monitoring"
],
"defaultStatus": "affected",
"packageName": "openshift-power-monitoring/power-monitoring-rhel9-operator",
"product": "Power monitoring for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unknown",
"packageName": "rhacm2/acm-governance-policy-addon-controller-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unknown",
"packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unknown",
"packageName": "rhacm2/config-policy-controller-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unknown",
"packageName": "rhacm2/governance-policy-propagator-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unknown",
"packageName": "rhacm2/klusterlet-addon-controller-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unknown",
"packageName": "rhacm2/thanos-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unknown",
"packageName": "ansible-automation-platform/platform-operator-bundle",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unknown",
"packageName": "automation-gateway-proxy",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unknown",
"packageName": "automation-gateway-proxy-openssl30",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unknown",
"packageName": "automation-gateway-proxy-openssl32",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:5"
],
"defaultStatus": "affected",
"packageName": "rhceph/rhceph-5-dashboard-rhel8",
"product": "Red Hat Ceph Storage 5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:6"
],
"defaultStatus": "affected",
"packageName": "rhceph/rhceph-6-dashboard-rhel9",
"product": "Red Hat Ceph Storage 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
],
"defaultStatus": "affected",
"packageName": "rhceph/alloy-rhel10",
"product": "Red Hat Ceph Storage 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:certifications:9"
],
"defaultStatus": "affected",
"packageName": "redhat-certification-preflight",
"product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1"
],
"defaultStatus": "unknown",
"packageName": "flightctl",
"product": "Red Hat Edge Manager 1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1"
],
"defaultStatus": "unknown",
"packageName": "rhem/flightctl-api-rhel9",
"product": "Red Hat Edge Manager 1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "buildah",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "golang",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "ignition",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "image-builder",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "opentelemetry-collector",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "osbuild-composer",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "podman",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "rhel10/bootc-image-builder",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "rhel10-eus/rhel-10.0-bootc-image-builder",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "skopeo",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "container-tools:rhel8/buildah",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "container-tools:rhel8/conmon",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "container-tools:rhel8/podman",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "container-tools:rhel8/skopeo",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "go-toolset:rhel8/golang",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "osbuild-composer",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "buildah",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "conmon",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "golang",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "ignition",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "image-builder",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "opentelemetry-collector",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "osbuild-composer",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "podman",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "rhel9/bootc-image-builder",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "rhel9-eus/rhel-9.6-bootc-image-builder",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "skopeo",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"packageName": "golang",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lightspeed_for_runtimes:1"
],
"defaultStatus": "unknown",
"packageName": "rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator",
"product": "Red Hat Lightspeed for Runtimes Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ai-gateway-payload-processing-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kube-auth-proxy-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kueue-controller-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llm-d-inference-scheduler-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llm-d-routing-sidecar-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-maas-api-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-mlflow-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ml-pipelines-driver-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ml-pipelines-launcher-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-model-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-serving-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-model-registry-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-model-registry-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-model-serving-api-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workload-variant-autoscaler-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_cluster_manager_cli:1"
],
"defaultStatus": "affected",
"packageName": "ocm-cli-clients/ocm-cli-rhel9",
"product": "Red Hat OpenShift Cluster Manager CLI",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "conmon",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "ignition",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "kata-containers",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "microshift",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-installer",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-node",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-sdn-rhel7",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-sdn-rhel8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-sdn-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift-golang-builder-container",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "ose-azure-acr-image-credential-provider",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "ose-gcp-gcr-image-credential-provider",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "podman",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "skopeo",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "ocs4/cephcsi-rhel8",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "odf4/cephcsi-rhel8",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "odf4/cephcsi-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-cli-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "odf4/odf-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "affected",
"packageName": "devspaces/configbump-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "affected",
"packageName": "devspaces/traefik-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:devworkspace"
],
"defaultStatus": "affected",
"packageName": "devworkspace/devworkspace-rhel9-operator",
"product": "Red Hat OpenShift Dev Workspaces Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_distributed_tracing:3"
],
"defaultStatus": "affected",
"packageName": "rhosdt/tempo-rhel9",
"product": "Red Hat OpenShift distributed tracing 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:windows_machine_config"
],
"defaultStatus": "unaffected",
"packageName": "openshift4-wincw/windows-machine-config-rhel9-operator",
"product": "Red Hat OpenShift for Windows Containers",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "affected",
"packageName": "openshift-gitops-1/argocd-rhel8",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "affected",
"packageName": "openshift-gitops-1/argocd-rhel9",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "container-native-virtualization/kubevirt-apiserver-proxy-rhel9",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "container-native-virtualization/virt-api-rhel9",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "affected",
"packageName": "kubevirt",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "affected",
"packageName": "openshift-golang-builder-container",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "unaffected",
"packageName": "rhosp-rhel8/osp-director-operator-bundle",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "unaffected",
"packageName": "rhosp-rhel9/osp-director-operator-bundle",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "unaffected",
"packageName": "rhoso-operators/ovn-rhel9-operator",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"packageName": "quay/quay-builder-rhel8",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unknown",
"packageName": "satellite/iop-vmaas-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_interconnect:1"
],
"defaultStatus": "affected",
"packageName": "skupper-cli",
"product": "Red Hat Service Interconnect 1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_interconnect:2"
],
"defaultStatus": "affected",
"packageName": "skupper-cli",
"product": "Red Hat Service Interconnect 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "unknown",
"packageName": "rhtas/ec-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_security_profiles_operator:1"
],
"defaultStatus": "affected",
"packageName": "compliance/openshift-security-profiles-rhel8-operator",
"product": "Security Profiles Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:1"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
"product": "Zero Trust Workload Identity Manager",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-07T19:41:18.615Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1046",
"description": "Creation of Immutable Text Using String Concatenation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T12:32:00.287Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"name": "RHBZ#2467809",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54552"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54531"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56340"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34364"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36319"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36625"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36754"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33574"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17713"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17714"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41928"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54555"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54583"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54602"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33120"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33123"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33142"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33150"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54287"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54284"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54286"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54285"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54274"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54283"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42146"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41031"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36797"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57194"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:54552: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19"
},
{
"lang": "en",
"value": "RHSA-2026:47952: Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"lang": "en",
"value": "RHSA-2026:56340: Logging Subsystem for Red Hat OpenShift 6.5"
},
{
"lang": "en",
"value": "RHSA-2026:50843: Logging Subsystem for Red Hat OpenShift 6"
},
{
"lang": "en",
"value": "RHSA-2026:34364: Logging for Red Hat OpenShift 6.4"
},
{
"lang": "en",
"value": "RHSA-2026:51033: OpenShift API for Data Protection 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:43692: OpenShift API for Data Protection 1.6"
},
{
"lang": "en",
"value": "RHSA-2026:36319: Red Hat Advanced Cluster Security 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
},
{
"lang": "en",
"value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
},
{
"lang": "en",
"value": "RHSA-2026:17713: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:17714: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
},
{
"lang": "en",
"value": "RHSA-2026:50300: Red Hat Migration Toolkit for Applications 8.1"
},
{
"lang": "en",
"value": "RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2"
},
{
"lang": "en",
"value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:54555: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:54583: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:54602: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:33120: Red Hat OpenShift Service Mesh 3.0"
},
{
"lang": "en",
"value": "RHSA-2026:33123: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:33142: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:33150: Red Hat OpenShift Service Mesh 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:54287: Red Hat OpenShift Workload Availability 0.12"
},
{
"lang": "en",
"value": "RHSA-2026:54284: Red Hat OpenShift Workload Availability 0.13"
},
{
"lang": "en",
"value": "RHSA-2026:54286: Red Hat OpenShift Workload Availability 0.3"
},
{
"lang": "en",
"value": "RHSA-2026:54285: Red Hat OpenShift Workload Availability 0.7"
},
{
"lang": "en",
"value": "RHSA-2026:54274: Red Hat OpenShift Workload Availability 0.8"
},
{
"lang": "en",
"value": "RHSA-2026:54283: Red Hat OpenShift Workload Availability 5.7"
},
{
"lang": "en",
"value": "RHSA-2026:42146: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:43052: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:42796: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:41066: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:41031: Red Hat Quay 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:40262: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:57194: multicluster engine for Kubernetes 2.11"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-07T20:00:51.685Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-07T19:41:18.615Z",
"value": "Made public."
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/mail",
"product": "net/mail",
"programRoutines": [
{
"name": "addrParser.consumePhrase"
},
{
"name": "AddressParser.Parse"
},
{
"name": "AddressParser.ParseList"
},
{
"name": "Header.AddressList"
},
{
"name": "ParseAddress"
},
{
"name": "ParseAddressList"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.10",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.3",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T19:41:18.615Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/78987"
},
{
"url": "https://go.dev/cl/771520"
},
{
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"title": "Quadratic string concatenation in consumePhrase in net/mail"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-42499",
"datePublished": "2026-05-07T19:41:18.615Z",
"dateReserved": "2026-04-28T00:21:12.791Z",
"dateUpdated": "2026-08-20T12:32:00.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-42499",
"date": "2026-08-22",
"epss": "0.00798",
"percentile": "0.53783"
},
"microsoft_vex": {
"current_release_date": "2026-06-09T01:42:47.000Z",
"cve": "CVE-2026-42499",
"id": "msrc_CVE-2026-42499",
"initial_release_date": "2026-05-02T00:00:00.000Z",
"product_status:known_affected": "2",
"product_status:known_not_affected": "5",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Quadratic string concatenation in consumePhrase in net/mail",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-42499.json",
"version": "6"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-42499\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-05-07T20:16:44.540\",\"lastModified\":\"2026-08-20T13:18:32.607\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"Go standard library\",\"product\":\"net/mail\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"net/mail\",\"programRoutines\":[{\"name\":\"addrParser.consumePhrase\"},{\"name\":\"AddressParser.Parse\"},{\"name\":\"AddressParser.ParseList\"},{\"name\":\"Header.AddressList\"},{\"name\":\"ParseAddress\"},{\"name\":\"ParseAddressList\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.25.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.26.0-0\",\"lessThan\":\"1.26.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cri-o\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el8\"],\"versions\":[{\"version\":\"0:1.32.13-9.rhaos4.19.git2100f27.el9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el8\"],\"versions\":[{\"version\":\"0:4.19.0-202608111604.p2.g63adf01.assembly.stream.el9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-clients\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el8\"],\"versions\":[{\"version\":\"0:4.19.0-202608111604.p2.gb2a93a6.assembly.stream.el8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ose-aws-ecr-image-credential-provider\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el8\"],\"versions\":[{\"version\":\"0:4.19.0-202608111604.p2.g425c1c5.assembly.stream.el9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cert Manager support for Red Hat OpenShift release 1.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cert-manager/jetstack-cert-manager-rhel9\",\"cpes\":[\"cpe:/a:redhat:cert_manager:1.19::el9\"],\"versions\":[{\"version\":\"1786613805\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging for Red Hat OpenShift 6.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/logging-loki-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6.4::el9\"],\"versions\":[{\"version\":\"1782405469\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/logging-loki-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6.0::el9\"],\"versions\":[{\"version\":\"1785419067\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/logging-loki-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6.2::el9\"],\"versions\":[{\"version\":\"1784748010\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/logging-loki-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6.5::el9\"],\"versions\":[{\"version\":\"1786645248\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"oadp/oadp-velero-plugin-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.3::el9\"],\"versions\":[{\"version\":\"1785177357\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"oadp/oadp-velero-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.6::el9\"],\"versions\":[{\"version\":\"1784058822\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"advanced-cluster-security/rhacs-main-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"],\"versions\":[{\"version\":\"1783357116\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"advanced-cluster-security/rhacs-main-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"],\"versions\":[{\"version\":\"1783357140\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhdh/rhdh-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.10::el9\"],\"versions\":[{\"version\":\"1783447707\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhdh/rhdh-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.9::el9\"],\"versions\":[{\"version\":\"1782767215\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang1-25-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.25.10-2.2.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang1-26-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.26.3-2.2.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Migration Toolkit 1.8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhmtc/openshift-migration-controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:rhmt:1.8::el8\"],\"versions\":[{\"version\":\"1783953372\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Migration Toolkit for Applications 8.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"mta/mta-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8.1::el9\"],\"versions\":[{\"version\":\"1785171639\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Migration Toolkit for Applications 8.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"mta/mta-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8.2::el9\"],\"versions\":[{\"version\":\"1784211378\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-kueue-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783544461\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el9\"],\"versions\":[{\"version\":\"1786489910\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.20::el9\"],\"versions\":[{\"version\":\"1786494900\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.21::el9\"],\"versions\":[{\"version\":\"1786496647\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4/ose-hypershift-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4.21::el9\"],\"versions\":[{\"version\":\"1786573075\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-cni-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"],\"versions\":[{\"version\":\"1782222217\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-pilot-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"],\"versions\":[{\"version\":\"1782223341\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-proxyv2-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"],\"versions\":[{\"version\":\"1782296193\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"],\"versions\":[{\"version\":\"1782222607\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-cni-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"],\"versions\":[{\"version\":\"1782222163\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-pilot-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"],\"versions\":[{\"version\":\"1782223138\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-proxyv2-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"],\"versions\":[{\"version\":\"1782222394\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"],\"versions\":[{\"version\":\"1782222451\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-cni-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"],\"versions\":[{\"version\":\"1782226178\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-pilot-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"],\"versions\":[{\"version\":\"1782224487\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-proxyv2-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"],\"versions\":[{\"version\":\"1782303211\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"],\"versions\":[{\"version\":\"1782224541\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-cni-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"],\"versions\":[{\"version\":\"1782223045\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-pilot-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"],\"versions\":[{\"version\":\"1782222366\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-proxyv2-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"],\"versions\":[{\"version\":\"1782310747\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-service-mesh/istio-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"],\"versions\":[{\"version\":\"1782222038\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Workload Availability 0.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"workload-availability/node-healthcheck-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_nhc:0.12::el9\"],\"versions\":[{\"version\":\"1785202723\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Workload Availability 0.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"workload-availability/self-node-remediation-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_snr:0.13::el9\"],\"versions\":[{\"version\":\"1785203036\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Workload Availability 0.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"workload-availability/storage-based-remediation-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_sbr:0.3::el9\"],\"versions\":[{\"version\":\"1785203474\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Workload Availability 0.7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"workload-availability/machine-deletion-remediation-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_mdr:0.7::el9\"],\"versions\":[{\"version\":\"1785203508\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Workload Availability 0.8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"workload-availability/fence-agents-remediation-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_far:0.8::el9\"],\"versions\":[{\"version\":\"1785203079\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Workload Availability 5.7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"workload-availability/node-maintenance-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_nmo:5.7::el9\"],\"versions\":[{\"version\":\"1785202847\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"],\"versions\":[{\"version\":\"1783750447\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"],\"versions\":[{\"version\":\"1783751865\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"1784353904\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"],\"versions\":[{\"version\":\"1784351966\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"],\"versions\":[{\"version\":\"1783955846\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"],\"versions\":[{\"version\":\"1784125838\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"conforma-cli-stack-v1\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"],\"versions\":[{\"version\":\"4-1.4.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"4-1.4.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Assisted Installer for Red Hat OpenShift Container Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/assisted-installer-rhel9\",\"cpes\":[\"cpe:/a:redhat:assisted_installer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"build-of-trustee/trustee-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"confidential-compute-attestation-tech-preview/trustee-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-sandboxed-containers/osc-monitor-rhel9\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"cryostat/cryostat-storage-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Custom Metric Autoscaler operator for Red Hat Openshift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"external-secrets-operator/external-secrets-rhel9\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"File Integrity Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compliance/openshift-compliance-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:openshift_file_integrity_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Gatekeeper 3\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gatekeeper/gatekeeper-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:gatekeeper:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lvms4/lvms-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lvms4/topolvm-rhel8\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lvms4/topolvm-rhel9\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multiarch Tuning Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multiarch-tuning/multiarch-tuning-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:multiarch_tuning_operator\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/addon-manager-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/assisted-installer-rhel8\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/assisted-installer-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/backplane-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/clusterlifecycle-state-metrics-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/discovery-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/hypershift-addon-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/maestro-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/managedcluster-import-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/multicloud-manager-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/placement-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/registration-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/work-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-agent-rhel8\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability Operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"network-observability/network-observability-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"helm\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-pipelines-client\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kn-workflow-plugin\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-service-mesh/pilot-rhel8\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Power monitoring for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-power-monitoring/power-monitoring-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_power_monitoring\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/acm-governance-policy-addon-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/acm-governance-policy-framework-addon-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/config-policy-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/governance-policy-propagator-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/klusterlet-addon-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/thanos-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/platform-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway-proxy\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway-proxy-openssl30\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway-proxy-openssl32\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-5-dashboard-rhel8\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-6-dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/alloy-rhel10\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Certification Program for Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-certification-preflight\",\"cpes\":[\"cpe:/a:redhat:certifications:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"flightctl\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhem/flightctl-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"buildah\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ignition\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"osbuild-composer\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhel10/bootc-image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhel10-eus/rhel-10.0-bootc-image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/buildah\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/conmon\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/podman\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"go-toolset:rhel8/golang\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"osbuild-composer\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"buildah\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"conmon\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ignition\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"osbuild-composer\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhel9/bootc-image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhel9-eus/rhel-9.6-bootc-image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Lightspeed for Runtimes Operator\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:lightspeed_for_runtimes:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-ai-gateway-payload-processing-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-llmisvc-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kube-auth-proxy-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kueue-controller-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llm-d-inference-scheduler-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llm-d-routing-sidecar-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-maas-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlflow-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-ml-pipelines-api-server-v2-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-ml-pipelines-driver-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-ml-pipelines-launcher-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-gen-ai-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-modelmesh-serving-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-registry-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-registry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-serving-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workload-variant-autoscaler-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Cluster Manager CLI\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ocm-cli-clients/ocm-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"conmon\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ignition\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kata-containers\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"microshift\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-installer\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-node\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-sdn-rhel7\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-sdn-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-sdn-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ose-azure-acr-image-credential-provider\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ose-gcp-gcr-image-credential-provider\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ocs4/cephcsi-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/cephcsi-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/cephcsi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/odf-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/odf-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/configbump-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devspaces/traefik-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Workspaces Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"devworkspace/devworkspace-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:devworkspace\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosdt/tempo-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift for Windows Containers\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4-wincw/windows-machine-config-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:windows_machine_config\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-gitops-1/argocd-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-gitops-1/argocd-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/kubevirt-apiserver-proxy-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/virt-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kubevirt\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosp-rhel8/osp-director-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosp-rhel9/osp-director-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso-operators/ovn-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"quay/quay-builder-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-vmaas-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skupper-cli\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skupper-cli\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/ec-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Security Profiles Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compliance/openshift-security-profiles-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_security_profiles_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-08T16:55:28.873015Z\",\"id\":\"CVE-2026-42499\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1046\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.25.10\",\"matchCriteriaId\":\"1C966EF3-C51C-4239-B5FC-C44A5202FEC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.26.0\",\"versionEndExcluding\":\"1.26.3\",\"matchCriteriaId\":\"522E4CD0-2B99-4363-9C78-0BAFD988A2D6\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/771520\",\"source\":\"security@golang.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://go.dev/issue/78987\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/qcCIEXso47M\",\"source\":\"security@golang.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-4977\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17713\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17714\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33120\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33123\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33142\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33150\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33574\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34364\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36319\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36625\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36754\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36797\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40262\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41031\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41066\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41928\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42146\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42796\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43038\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43052\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43692\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47952\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50300\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50843\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:51033\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54274\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54283\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54284\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54285\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54286\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54287\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54531\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54552\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54555\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54583\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54602\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56340\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:57194\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-42499\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2467809\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-22T19:36:30+00:00",
"cve": "CVE-2026-42499",
"id": "CVE-2026-42499",
"initial_release_date": "2026-05-07T19:41:18.615000+00:00",
"product_status:fixed": "246",
"product_status:known_affected": "131",
"product_status:known_not_affected": "2935",
"product_status:under_investigation": "113",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-08-21T01:10:43Z",
"cve": "CVE-2026-42499",
"id": "CVE-2026-42499",
"initial_release_date": "2026-05-09T02:42:51Z",
"product_status:known_affected": "19",
"product_status:known_not_affected": "117",
"product_status:recommended": "271",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-42499",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-42499.json",
"version": "15"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"net/mail: golang: net/mail: Denial of Service via pathological email address parsing\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:cert_manager:1.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cert Manager support for Red Hat OpenShift release 1.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786613805\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"cert-manager/jetstack-cert-manager-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging for Red Hat OpenShift 6.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785419067\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-logging/logging-loki-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging for Red Hat OpenShift 6.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784748010\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-logging/logging-loki-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging for Red Hat OpenShift 6.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782405469\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-logging/logging-loki-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785177357\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"oadp/oadp-velero-plugin-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784058822\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"oadp/oadp-velero-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783357116\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"advanced-cluster-security/rhacs-main-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783357140\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"advanced-cluster-security/rhacs-main-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.10::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783447707\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhdh/rhdh-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782767215\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhdh/rhdh-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.25.10-2.2.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"golang1-25-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.26.3-2.2.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"golang1-26-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Migration Toolkit for Applications 8.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785171639\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"mta/mta-cli-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Migration Toolkit for Applications 8.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784211378\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"mta/mta-cli-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1.8::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Migration Toolkit for Containers 1.8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783953372\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhmtc/openshift-migration-controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783544461\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-kueue-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782222217\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-cni-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782223341\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-pilot-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782296193\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-proxyv2-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782222607\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782222163\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-cni-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782223138\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-pilot-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782222394\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-proxyv2-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782222451\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782226178\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-cni-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782224487\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-pilot-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782303211\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-proxyv2-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782224541\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782223045\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-cni-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782222366\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-pilot-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782310747\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-proxyv2-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782222038\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-service-mesh/istio-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_nhc:0.12::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Workload Availability 0.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785202723\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"workload-availability/node-healthcheck-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_snr:0.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Workload Availability 0.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785203036\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"workload-availability/self-node-remediation-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_sbr:0.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Workload Availability 0.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785203474\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"workload-availability/storage-based-remediation-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_mdr:0.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Workload Availability 0.7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785203508\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"workload-availability/machine-deletion-remediation-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_far:0.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Workload Availability 0.8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785203079\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"workload-availability/fence-agents-remediation-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_nmo:5.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Workload Availability 5.7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785202847\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"workload-availability/node-maintenance-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783750447\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783751865\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"1784353904\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784351966\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783955846\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784125838\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4-1.4.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"4-1.4.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"conforma-cli-stack-v1\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:assisted_installer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Assisted Installer for Red Hat OpenShift Container Platform 2\", \"packageName\": \"rhai/assisted-installer-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"packageName\": \"build-of-trustee/trustee-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"packageName\": \"confidential-compute-attestation-tech-preview/trustee-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"packageName\": \"openshift-sandboxed-containers/osc-monitor-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"cryostat/cryostat-storage-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2\"], \"vendor\": \"Red Hat\", \"product\": \"Custom Metric Autoscaler operator for Red Hat Openshift\", \"packageName\": \"custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"packageName\": \"external-secrets-operator/external-secrets-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_file_integrity_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"File Integrity Operator\", \"packageName\": \"compliance/openshift-compliance-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:gatekeeper:3\"], \"vendor\": \"Red Hat\", \"product\": \"Gatekeeper 3\", \"packageName\": \"gatekeeper/gatekeeper-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"packageName\": \"lvms4/lvms-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"packageName\": \"lvms4/topolvm-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"packageName\": \"lvms4/topolvm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multiarch_tuning_operator\"], \"vendor\": \"Red Hat\", \"product\": \"Multiarch Tuning Operator\", \"packageName\": \"multiarch-tuning/multiarch-tuning-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/addon-manager-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/assisted-installer-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/assisted-installer-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/backplane-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/clusterlifecycle-state-metrics-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/discovery-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/hypershift-addon-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/maestro-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/managedcluster-import-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/multicloud-manager-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/placement-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/registration-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/work-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub\", \"packageName\": \"multicluster-globalhub/multicluster-globalhub-agent-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub\", \"packageName\": \"multicluster-globalhub/multicluster-globalhub-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability Operator\", \"packageName\": \"network-observability/network-observability-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"helm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"packageName\": \"openshift-pipelines-client\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"kn-workflow-plugin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 2\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 2\", \"packageName\": \"openshift-service-mesh/pilot-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_power_monitoring\"], \"vendor\": \"Red Hat\", \"product\": \"Power monitoring for Red Hat OpenShift\", \"packageName\": \"openshift-power-monitoring/power-monitoring-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/acm-governance-policy-addon-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/acm-governance-policy-framework-addon-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/config-policy-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/governance-policy-propagator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/klusterlet-addon-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/thanos-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform/platform-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-gateway-proxy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-gateway-proxy-openssl30\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-gateway-proxy-openssl32\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:5\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 5\", \"packageName\": \"rhceph/rhceph-5-dashboard-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 6\", \"packageName\": \"rhceph/rhceph-6-dashboard-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 9\", \"packageName\": \"rhceph/alloy-rhel10\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:certifications:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Certification Program for Red Hat Enterprise Linux 9\", \"packageName\": \"redhat-certification-preflight\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1\", \"packageName\": \"flightctl\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1\", \"packageName\": \"rhem/flightctl-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"buildah\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"golang\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"ignition\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"opentelemetry-collector\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"rhel10/bootc-image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"rhel10-eus/rhel-10.0-bootc-image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/buildah\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/conmon\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"go-toolset:rhel8/golang\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"buildah\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"conmon\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"golang\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"ignition\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"opentelemetry-collector\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"rhel9/bootc-image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"rhel9-eus/rhel-9.6-bootc-image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"golang\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_for_runtimes:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Lightspeed for Runtimes Operator\", \"packageName\": \"rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-ai-gateway-payload-processing-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-llmisvc-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kube-auth-proxy-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kueue-controller-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llm-d-inference-scheduler-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llm-d-routing-sidecar-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-maas-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlflow-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-ml-pipelines-api-server-v2-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-ml-pipelines-driver-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-ml-pipelines-launcher-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-gen-ai-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-modelmesh-serving-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-registry-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-registry-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-serving-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workload-variant-autoscaler-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Cluster Manager CLI\", \"packageName\": \"ocm-cli-clients/ocm-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"conmon\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"cri-o\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ignition\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"kata-containers\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"microshift\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-hypershift-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-installer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-node\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-sdn-rhel7\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-sdn-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-sdn-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift-clients\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ose-aws-ecr-image-credential-provider\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ose-azure-acr-image-credential-provider\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ose-gcp-gcr-image-credential-provider\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"ocs4/cephcsi-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/cephcsi-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/cephcsi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/odf-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/odf-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/configbump-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/traefik-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:devworkspace\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Workspaces Operator\", \"packageName\": \"devworkspace/devworkspace-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3\", \"packageName\": \"rhosdt/tempo-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:windows_machine_config\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift for Windows Containers\", \"packageName\": \"openshift4-wincw/windows-machine-config-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"packageName\": \"openshift-gitops-1/argocd-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"packageName\": \"openshift-gitops-1/argocd-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/kubevirt-apiserver-proxy-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/virt-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"kubevirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"packageName\": \"rhosp-rhel8/osp-director-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"rhosp-rhel9/osp-director-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso-operators/ovn-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3\", \"packageName\": \"quay/quay-builder-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-vmaas-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 1\", \"packageName\": \"skupper-cli\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 2\", \"packageName\": \"skupper-cli\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/ec-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_security_profiles_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Security Profiles Operator\", \"packageName\": \"compliance/openshift-security-profiles-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-07T20:00:51.685Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-07T19:41:18.615Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:47952: Logging Subsystem for Red Hat OpenShift 6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:56340: Logging Subsystem for Red Hat OpenShift 6.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50843: Logging Subsystem for Red Hat OpenShift 6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34364: Logging for Red Hat OpenShift 6.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:51033: OpenShift API for Data Protection 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:43692: OpenShift API for Data Protection 1.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36319: Red Hat Advanced Cluster Security 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36754: Red Hat Developer Hub 1.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33574: Red Hat Developer Hub 1.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17713: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17714: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41928: Red Hat Migration Toolkit 1.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50300: Red Hat Migration Toolkit for Applications 8.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42644: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54583: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54602: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33120: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33123: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33142: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33150: Red Hat OpenShift Service Mesh 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54287: Red Hat OpenShift Workload Availability 0.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54284: Red Hat OpenShift Workload Availability 0.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54286: Red Hat OpenShift Workload Availability 0.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54285: Red Hat OpenShift Workload Availability 0.7\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54274: Red Hat OpenShift Workload Availability 0.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54283: Red Hat OpenShift Workload Availability 5.7\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42146: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:43052: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42796: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41066: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41031: Red Hat Quay 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40262: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-07T19:41:18.615Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-42499\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2467809\", \"name\": \"RHBZ#2467809\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54531\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47952\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:56340\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50843\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34364\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:51033\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:43692\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36319\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36625\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36754\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33574\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17713\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17714\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41928\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50300\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:43038\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54583\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54602\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33120\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33123\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33142\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33150\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54287\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54284\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54286\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54285\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54274\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54283\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42146\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:43052\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42796\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41066\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41031\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40262\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36797\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1046\", \"description\": \"Creation of Immutable Text Using String Concatenation\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-19T12:05:03.823Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42499\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-08T16:55:28.873015Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-08T16:55:43.428Z\"}}], \"cna\": {\"title\": \"Quadratic string concatenation in consumePhrase in net/mail\", \"affected\": [{\"vendor\": \"Go standard library\", \"product\": \"net/mail\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.25.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.26.0-0\", \"lessThan\": \"1.26.3\", \"versionType\": \"semver\"}], \"packageName\": \"net/mail\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"addrParser.consumePhrase\"}, {\"name\": \"AddressParser.Parse\"}, {\"name\": \"AddressParser.ParseList\"}, {\"name\": \"Header.AddressList\"}, {\"name\": \"ParseAddress\"}, {\"name\": \"ParseAddressList\"}]}], \"references\": [{\"url\": \"https://go.dev/issue/78987\"}, {\"url\": \"https://go.dev/cl/771520\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/qcCIEXso47M\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-4977\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-407: Inefficient Algorithmic Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-05-07T19:41:18.615Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-42499\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-19T12:05:03.823Z\", \"dateReserved\": \"2026-04-28T00:21:12.791Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-05-07T19:41:18.615Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:43038
Vulnerability from csaf_redhat - Published: 2026-07-21 22:10 - Updated: 2026-08-22 21:39Summary
Red Hat Security Advisory: Migration Toolkit for Applications
Severity
Critical
Notes
Topic: A new version of Migration Toolkit for Applications (MTA) is now available.
Details: Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift.
This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage
applications for faster migration to OpenShift via the user interface.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This allows a remote attacker with low privileges to bypass directory restrictions and gain unauthorized read and write access to files in sibling directories. This could lead to the exposure of sensitive data, particularly in shared hosting environments.
6.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Moderate
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI's intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.
7.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jupyter Server. An authenticated user can exploit a path traversal vulnerability in the REST API to escape the configured root directory (`root_dir`). By crafting a request to the `/api/contents` endpoint with encoded path components, an attacker can gain access to sibling directories whose names begin with the same prefix as the `root_dir`. This allows the attacker to read, write, and delete files in these accessible sibling directories, potentially leading to unauthorized data access and modification, especially in multi-tenant environments.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jupyter Server. The Origin header validation, which uses Python's `re.match()` function, does not correctly validate incoming origins against allowed patterns. This allows a remote attacker to bypass Cross-Origin Resource Sharing (CORS) restrictions by crafting a malicious domain that partially matches a trusted one. Consequently, the attacker can make unauthorized cross-origin requests to the Jupyter Server API from an untrusted site, potentially leading to sensitive information disclosure or other unauthorized actions.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jupyter Notebook and JupyterLab. A stored cross-site scripting (XSS) vulnerability in the help command linker can be exploited by an attacker who crafts a malicious notebook file. When a user interacts with this file, the XSS is triggered, allowing the attacker to steal authentication tokens. Successful exploitation can lead to a complete takeover of the Jupyter session, enabling arbitrary code execution and information disclosure.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in JupyterLab, an extensible environment for interactive computing. The PyPI Extension Manager, responsible for installing extensions, failed to properly enforce its allow-list of approved extensions. This vulnerability allowed for the installation of unauthorized extensions from sources outside the default PyPI index. Exploitation of this flaw could lead to arbitrary code execution and significant system compromise.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jupyterlab. This vulnerability allows a remote attacker to achieve arbitrary code execution by presenting a user with a specially crafted notebook containing a deceptive button in its pre-saved HTML cell output. When the user clicks this button, the CommandLinker component executes arbitrary JupyterLab commands without sufficient validation, leading to the execution of unauthorized code.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in python-multipart. A remote attacker can exploit this denial of service (DoS) vulnerability by sending a specially crafted request with an excessive number of part headers or a single very large header value during multipart/form-data parsing. This can lead to excessive CPU utilization, resulting in a denial of service for the affected system.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in Jupyter Server. The nbconvert HTTP handlers in Jupyter Server render user-authored notebook HTML without a sandbox directive in their Content-Security-Policy. This, combined with nbconvert.HTMLExporter's default non-sanitizing behavior, allows a notebook containing an HTML payload to trigger a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker could exploit this to gain cookie access, full API authority, and achieve kernel Remote Code Execution (RCE).
9.0 (Critical)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in LangChain, a framework for building agents and large language model (LLM)-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists. A remote attacker can exploit this by supplying specially crafted LangChain serialized constructor dictionaries, leading to the instantiation of classes with untrusted arguments. This can result in the disclosure of sensitive information and potential partial compromise of data integrity.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high CPU consumption. This can result in a Denial of Service (DoS) for the affected service. Furthermore, because baggage is automatically re-injected into outgoing requests, the impact can spread to other downstream services.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability, residing in ASGI web servers and Starlette's trust in them, allows an attacker to bypass the OpenAI API Authentication Middleware. This bypass enables unauthorized access to the API without requiring the configured VLLM_API_KEY or --api-key, leading to critical unauthorized operations.
9.1 (Critical)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.
5.3 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Starlette where the request.form() method silently ignores configured resource limits (max_fields and max_part_size) when parsing application/x-www-form-urlencoded data. An unauthenticated attacker can exploit this by sending a urlencoded request body with an arbitrarily large number of fields or an oversized field, causing denial of service through resource exhaustion.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial of Service (DoS) by causing the client application to run out of memory and crash.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
References
225 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of Migration Toolkit for Applications (MTA) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. \nThis solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage\napplications for faster migration to OpenShift via the user interface.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:43038",
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
"url": "https://access.redhat.com/security/cve/CVE-2026-13676"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-28684",
"url": "https://access.redhat.com/security/cve/CVE-2026-28684"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33079",
"url": "https://access.redhat.com/security/cve/CVE-2026-33079"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34993",
"url": "https://access.redhat.com/security/cve/CVE-2026-34993"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35397",
"url": "https://access.redhat.com/security/cve/CVE-2026-35397"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40110",
"url": "https://access.redhat.com/security/cve/CVE-2026-40110"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40171",
"url": "https://access.redhat.com/security/cve/CVE-2026-40171"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42266",
"url": "https://access.redhat.com/security/cve/CVE-2026-42266"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42557",
"url": "https://access.redhat.com/security/cve/CVE-2026-42557"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42561",
"url": "https://access.redhat.com/security/cve/CVE-2026-42561"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44727",
"url": "https://access.redhat.com/security/cve/CVE-2026-44727"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44843",
"url": "https://access.redhat.com/security/cve/CVE-2026-44843"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45292",
"url": "https://access.redhat.com/security/cve/CVE-2026-45292"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48746",
"url": "https://access.redhat.com/security/cve/CVE-2026-48746"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48990",
"url": "https://access.redhat.com/security/cve/CVE-2026-48990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5422",
"url": "https://access.redhat.com/security/cve/CVE-2026-5422"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54283",
"url": "https://access.redhat.com/security/cve/CVE-2026-54283"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59939",
"url": "https://access.redhat.com/security/cve/CVE-2026-59939"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6322",
"url": "https://access.redhat.com/security/cve/CVE-2026-6322"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://developers.redhat.com/products/mta/overview",
"url": "https://developers.redhat.com/products/mta/overview"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/",
"url": "https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43038.json"
}
],
"title": "Red Hat Security Advisory: Migration Toolkit for Applications",
"tracking": {
"current_release_date": "2026-08-22T21:39:02+00:00",
"generator": {
"date": "2026-08-22T21:39:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:43038",
"initial_release_date": "2026-07-21T22:10:10+00:00",
"revision_history": [
{
"date": "2026-07-21T22:10:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T21:39:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Migration Toolkit for Applications 8.2",
"product": {
"name": "Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:migration_toolkit_applications:8.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Migration Toolkit for Applications"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"product_id": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-analyzer-addon-rhel9@sha256%3A1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-analyzer-addon-rhel9\u0026tag=1784163267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"product_id": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-cli-rhel9@sha256%3Ad466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-cli-rhel9\u0026tag=1784211378"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"product_id": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-discovery-addon-rhel9@sha256%3Aa72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-discovery-addon-rhel9\u0026tag=1784056873"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"product_id": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-dotnet-external-provider-rhel9@sha256%3A794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-dotnet-external-provider-rhel9\u0026tag=1784056823"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"product_id": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-go-external-provider-rhel9@sha256%3A8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-go-external-provider-rhel9\u0026tag=1784162259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"product_id": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-hub-rhel9@sha256%3A2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-hub-rhel9\u0026tag=1784059743"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"product_id": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-java-external-provider-rhel9@sha256%3Ae8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-java-external-provider-rhel9\u0026tag=1784210217"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"product_id": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-nodejs-external-provider-rhel9@sha256%3A12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-nodejs-external-provider-rhel9\u0026tag=1784162266"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"product_id": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-rhel9-operator@sha256%3A3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-rhel9-operator\u0026tag=1784219586"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"product_id": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-operator-bundle@sha256%3A94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-operator-bundle\u0026tag=1784220119"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"product_id": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-platform-addon-rhel9@sha256%3Af421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-platform-addon-rhel9\u0026tag=1784059659"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"product_id": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-python-external-provider-rhel9@sha256%3A4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-python-external-provider-rhel9\u0026tag=1784162359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"product_id": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-solution-server-rhel9@sha256%3A21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-solution-server-rhel9\u0026tag=1784109883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"product_id": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-ui-rhel9@sha256%3Aa77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-ui-rhel9\u0026tag=1783962515"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"product_id": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-analyzer-addon-rhel9@sha256%3A907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-analyzer-addon-rhel9\u0026tag=1784163267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"product_id": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-cli-rhel9@sha256%3Aecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-cli-rhel9\u0026tag=1784211378"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"product_id": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-discovery-addon-rhel9@sha256%3A7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-discovery-addon-rhel9\u0026tag=1784056873"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"product_id": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-dotnet-external-provider-rhel9@sha256%3Ab5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-dotnet-external-provider-rhel9\u0026tag=1784056823"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"product_id": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-go-external-provider-rhel9@sha256%3A8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-go-external-provider-rhel9\u0026tag=1784162259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"product_id": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-hub-rhel9@sha256%3A0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-hub-rhel9\u0026tag=1784059743"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"product_id": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-java-external-provider-rhel9@sha256%3A60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-java-external-provider-rhel9\u0026tag=1784210217"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"product_id": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-nodejs-external-provider-rhel9@sha256%3Aa89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-nodejs-external-provider-rhel9\u0026tag=1784162266"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"product_id": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-rhel9-operator@sha256%3A957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-rhel9-operator\u0026tag=1784219586"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"product_id": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-platform-addon-rhel9@sha256%3A647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-platform-addon-rhel9\u0026tag=1784059659"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"product_id": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-python-external-provider-rhel9@sha256%3A25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-python-external-provider-rhel9\u0026tag=1784162359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"product_id": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-solution-server-rhel9@sha256%3Af8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-solution-server-rhel9\u0026tag=1784109883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"product_id": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-ui-rhel9@sha256%3Af59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-ui-rhel9\u0026tag=1783962515"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5422",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-02T10:01:06.656531+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484037"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This allows a remote attacker with low privileges to bypass directory restrictions and gain unauthorized read and write access to files in sibling directories. This could lead to the exposure of sensitive data, particularly in shared hosting environments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate vulnerability in jupyter-server allows a remote, low-privileged attacker to bypass directory restrictions. An incorrect root directory boundary check and improper handling of traversal sequences enable unauthorized read and write access to files in sibling directories. This poses a risk of sensitive data exposure, particularly in Red Hat OpenShift AI deployments utilizing shared hosting environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5422"
},
{
"category": "external",
"summary": "RHBZ#2484037",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484037"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5422"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5422",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5422"
},
{
"category": "external",
"summary": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f",
"url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
}
],
"release_date": "2026-06-02T09:11:15.755000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability"
},
{
"cve": "CVE-2026-6322",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-05-05T11:01:00.332189+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI\u0027s intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the `fast-uri` library allows an attacker to bypass security controls in Red Hat products that process Uniform Resource Identifiers (URIs). By crafting a malicious URI with percent-encoded authority delimiters, an attacker can cause the library to incorrectly interpret the URI\u0027s authority, potentially redirecting applications to an unintended domain. This could lead to a bypass of host allowlist checks, redirect validation, or outbound request routing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6322"
},
{
"category": "external",
"summary": "RHBZ#2466684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6322"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc"
}
],
"release_date": "2026-05-05T10:29:16.378000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling"
},
{
"cve": "CVE-2026-13676",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-06-29T14:01:55.592330+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494197"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13676"
},
{
"category": "external",
"summary": "RHBZ#2494197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
}
],
"release_date": "2026-06-29T13:22:44.674000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
},
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-28684",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-04-20T17:02:18.205732+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459798"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28684"
},
{
"category": "external",
"summary": "RHBZ#2459798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459798"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28684"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28684",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28684"
},
{
"category": "external",
"summary": "https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311",
"url": "https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"
},
{
"category": "external",
"summary": "https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2",
"url": "https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"
},
{
"category": "external",
"summary": "https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94",
"url": "https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"
}
],
"release_date": "2026-04-20T16:25:12.302000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following"
},
{
"cve": "CVE-2026-33079",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-05-06T18:01:13.818581+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467298"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Mistune Markdown parser can lead to a denial of service in Red Hat OpenShift AI and Migration Toolkit for Applications. A remote attacker can exploit a Regular Expression Denial of Service (ReDoS) vulnerability by submitting specially crafted Markdown input, causing excessive CPU consumption and rendering affected applications unresponsive. This impact is significant as it directly affects the availability of services that process untrusted Markdown content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33079"
},
{
"category": "external",
"summary": "RHBZ#2467298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467298"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33079"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33079",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33079"
},
{
"category": "external",
"summary": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25",
"url": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25"
},
{
"category": "external",
"summary": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp",
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"
}
],
"release_date": "2026-05-06T17:25:09.026000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-34993",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-02T20:01:12.690409+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484099"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in AIOHTTP, a Python asynchronous HTTP framework, due to potential arbitrary code execution. The vulnerability arises when applications load untrusted input into the `CookieJar.load()` function. Exploitation requires an application to be configured to process attacker-controlled files, which is not a default or common scenario in most Red Hat product deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34993"
},
{
"category": "external",
"summary": "RHBZ#2484099",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484099"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34993"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34993",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34993"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00",
"url": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"
}
],
"release_date": "2026-06-02T18:29:15.847000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Applications using AIOHTTP that are configured to load untrusted files via the `CookieJar.load()` function should implement input sanitization prior to loading. This prevents the injection of malicious code.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()"
},
{
"cve": "CVE-2026-35397",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-05T20:01:20.132731+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466858"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Server. An authenticated user can exploit a path traversal vulnerability in the REST API to escape the configured root directory (`root_dir`). By crafting a request to the `/api/contents` endpoint with encoded path components, an attacker can gain access to sibling directories whose names begin with the same prefix as the `root_dir`. This allows the attacker to read, write, and delete files in these accessible sibling directories, potentially leading to unauthorized data access and modification, especially in multi-tenant environments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jupyter Server enables an authenticated user to bypass their configured root directory via a path traversal vulnerability in the REST API. This allows access to, and manipulation of, files within sibling directories that share a common prefix. The risk is elevated in multi-tenant Red Hat OpenShift AI environments where predictable directory naming conventions are often employed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35397"
},
{
"category": "external",
"summary": "RHBZ#2466858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466858"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35397"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35397",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35397"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3",
"url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3"
}
],
"release_date": "2026-05-05T19:37:33.810000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that directory names within Jupyter Server deployments do not share common prefixes with sibling directories. This operational control prevents authenticated users from exploiting the path traversal vulnerability to access unauthorized content. For example, avoid naming directories \u0027user1\u0027 and \u0027user10\u0027 if \u0027user\u0027 is a common prefix. This mitigation does not require service restarts or reloads.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-40110",
"cwe": {
"id": "CWE-625",
"name": "Permissive Regular Expression"
},
"discovery_date": "2026-05-05T22:01:09.643884+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466912"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Server. The Origin header validation, which uses Python\u0027s `re.match()` function, does not correctly validate incoming origins against allowed patterns. This allows a remote attacker to bypass Cross-Origin Resource Sharing (CORS) restrictions by crafting a malicious domain that partially matches a trusted one. Consequently, the attacker can make unauthorized cross-origin requests to the Jupyter Server API from an untrusted site, potentially leading to sensitive information disclosure or other unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40110"
},
{
"category": "external",
"summary": "RHBZ#2466912",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466912"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40110",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40110"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40110",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40110"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea",
"url": "https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8",
"url": "https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/pull/603",
"url": "https://github.com/jupyter-server/jupyter_server/pull/603"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p",
"url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p"
}
],
"release_date": "2026-05-05T21:29:31.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Administrators should review and update the `allow_origin_pat` configuration in Jupyter Server to use a more precise regular expression. Ensure the pattern explicitly anchors to the end of the string (e.g., by adding `$` to the end of the regex) to prevent partial domain matches. After modifying the configuration, the Jupyter Server service must be restarted for the changes to take effect.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation"
},
{
"cve": "CVE-2026-40171",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-06T20:00:54.861152+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Notebook and JupyterLab. A stored cross-site scripting (XSS) vulnerability in the help command linker can be exploited by an attacker who crafts a malicious notebook file. When a user interacts with this file, the XSS is triggered, allowing the attacker to steal authentication tokens. Successful exploitation can lead to a complete takeover of the Jupyter session, enabling arbitrary code execution and information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Jupyter Notebook: JupyterLab: @jupyter-notebook/help-extension: @jupyterlab/help-extension: Jupyter Notebook and JupyterLab: Session takeover via stored cross-site scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Jupyter Notebook and JupyterLab, enabling a stored cross-site scripting (XSS) attack. An attacker can craft a malicious notebook that, with a single user click, can steal authentication tokens and fully compromise the Jupyter session, leading to arbitrary code execution and information disclosure. This impacts Red Hat OpenShift AI and Migration Toolkit for Applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40171"
},
{
"category": "external",
"summary": "RHBZ#2467453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40171"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40171",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40171"
},
{
"category": "external",
"summary": "https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9",
"url": "https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9"
}
],
"release_date": "2026-05-06T19:36:32.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To reduce the risk of exploitation, disable the affected help extensions in Jupyter Notebook and JupyterLab, or set the `allowCommandLinker` option to `false` within the sanitizer configuration. Consult the Jupyter documentation for specific instructions on modifying these settings. Disabling these features may affect the availability of certain help functionalities.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Jupyter Notebook: JupyterLab: @jupyter-notebook/help-extension: @jupyterlab/help-extension: Jupyter Notebook and JupyterLab: Session takeover via stored cross-site scripting"
},
{
"cve": "CVE-2026-42266",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-05-13T16:02:13.807767+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477072"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in JupyterLab, an extensible environment for interactive computing. The PyPI Extension Manager, responsible for installing extensions, failed to properly enforce its allow-list of approved extensions. This vulnerability allowed for the installation of unauthorized extensions from sources outside the default PyPI index. Exploitation of this flaw could lead to arbitrary code execution and significant system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in JupyterLab, as utilized in Red Hat OpenShift AI and Migration Toolkit for Applications, stems from the PyPI Extension Manager\u0027s failure to enforce its extension allow-list. This enables the installation of unauthorized extensions from external sources, potentially leading to arbitrary code execution and significant system compromise within the JupyterLab environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42266"
},
{
"category": "external",
"summary": "RHBZ#2477072",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477072"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42266"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42266",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42266"
},
{
"category": "external",
"summary": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4",
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4"
}
],
"release_date": "2026-05-13T15:08:49.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Upgrade JupyterLab to version 4.5.7 or later.\n\nSet the JupyterLab extension manager to read-only mode to prevent users from installing unauthorized extensions. Note: configuring a PyPI proxy with an allow list of packages is not sufficient to protect against this vulnerability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42504",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-02T23:01:00.320527+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "RHBZ#2484204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://go.dev/cl/774481",
"url": "https://go.dev/cl/774481"
},
{
"category": "external",
"summary": "https://go.dev/issue/79217",
"url": "https://go.dev/issue/79217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5038",
"url": "https://pkg.go.dev/vuln/GO-2026-5038"
}
],
"release_date": "2026-06-02T22:01:37.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
},
{
"cve": "CVE-2026-42557",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-13T16:02:57.063403+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477086"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jupyterlab. This vulnerability allows a remote attacker to achieve arbitrary code execution by presenting a user with a specially crafted notebook containing a deceptive button in its pre-saved HTML cell output. When the user clicks this button, the CommandLinker component executes arbitrary JupyterLab commands without sufficient validation, leading to the execution of unauthorized code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyterlab: JupyterLab: Arbitrary code execution via deceptive button in HTML output",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in JupyterLab allows arbitrary code execution through a deceptive button embedded in a notebook\u0027s HTML output. When a user clicks this specially crafted button, the CommandLinker component executes unauthorized JupyterLab commands, bypassing security validation. This can lead to compromise of the user\u0027s environment, including data loss or denial of service, particularly in Red Hat products utilizing JupyterLab such as Migration Toolkit for Applications and Red Hat OpenShift AI. Exploitation requires user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42557"
},
{
"category": "external",
"summary": "RHBZ#2477086",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477086"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42557"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42557",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42557"
},
{
"category": "external",
"summary": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg",
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg"
}
],
"release_date": "2026-05-13T15:06:14.222000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Users should avoid opening or interacting with JupyterLab notebooks from untrusted sources. Exercise caution and verify the origin of any notebook before clicking buttons within its output, as this action could lead to the execution of arbitrary commands.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyterlab: JupyterLab: Arbitrary code execution via deceptive button in HTML output"
},
{
"cve": "CVE-2026-42561",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-13T22:01:05.319675+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-multipart. A remote attacker can exploit this denial of service (DoS) vulnerability by sending a specially crafted request with an excessive number of part headers or a single very large header value during multipart/form-data parsing. This can lead to excessive CPU utilization, resulting in a denial of service for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in python-multipart. A remote attacker can trigger excessive CPU utilization by sending specially crafted multipart/form-data requests, leading to service disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42561"
},
{
"category": "external",
"summary": "RHBZ#2477309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42561"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42561",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42561"
},
{
"category": "external",
"summary": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g",
"url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g"
}
],
"release_date": "2026-05-13T20:55:11.767000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers"
},
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-44727",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-22T21:00:50.127940+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491516"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Server. The nbconvert HTTP handlers in Jupyter Server render user-authored notebook HTML without a sandbox directive in their Content-Security-Policy. This, combined with nbconvert.HTMLExporter\u0027s default non-sanitizing behavior, allows a notebook containing an HTML payload to trigger a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker could exploit this to gain cookie access, full API authority, and achieve kernel Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: Jupyter Server: Remote Code Execution via stored Cross-Site Scripting in nbconvert handlers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44727"
},
{
"category": "external",
"summary": "RHBZ#2491516",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491516"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44727",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44727"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44727",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44727"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd",
"url": "https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmp",
"url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmp"
}
],
"release_date": "2026-06-22T19:56:56.776000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyter-server: Jupyter Server: Remote Code Execution via stored Cross-Site Scripting in nbconvert handlers"
},
{
"cve": "CVE-2026-44843",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-26T21:01:18.783998+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481695"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in LangChain, a framework for building agents and large language model (LLM)-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists. A remote attacker can exploit this by supplying specially crafted LangChain serialized constructor dictionaries, leading to the instantiation of classes with untrusted arguments. This can result in the disclosure of sensitive information and potential partial compromise of data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in LangChain allows a remote attacker to achieve information disclosure and partial data integrity compromise. The flaw arises from overly broad object allowlists in older runtime code paths, which can deserialize attacker-controlled payloads and instantiate classes with untrusted arguments. Red Hat products integrating LangChain are affected if they process untrusted structured input and utilize deprecated APIs such as RunnableWithMessageHistory, astream_log(), or astream_events(version=\"v1\"), potentially leading to prompt injection or sensitive data exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44843"
},
{
"category": "external",
"summary": "RHBZ#2481695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44843",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44843"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44843",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44843"
},
{
"category": "external",
"summary": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724",
"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724"
}
],
"release_date": "2026-05-26T19:47:35.328000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications using LangChain should avoid passing untrusted structured input directly to load() or loads() functions. Instead, ensure all incoming untrusted data is validated and canonicalized into an inert schema before being processed by LangChain. Additionally, migrate away from deprecated LangChain APIs, including RunnableWithMessageHistory, astream_log(), and astream_events(version=\"v1\"), as these older code paths are more susceptible to insecure deserialization.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization"
},
{
"cve": "CVE-2026-45292",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-28T17:02:14.674828+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482785"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high CPU consumption. This can result in a Denial of Service (DoS) for the affected service. Furthermore, because baggage is automatically re-injected into outgoing requests, the impact can spread to other downstream services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in OpenTelemetry Java\u0027s baggage propagation, affecting Red Hat products that use OpenTelemetry for telemetry. A remote attacker can exploit this by sending excessively large baggage, leading to uncontrolled memory and CPU usage. The vulnerability\u0027s impact can extend to downstream services due to automatic re-injection of baggage into outgoing requests.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45292"
},
{
"category": "external",
"summary": "RHBZ#2482785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482785"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
"url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/pull/8380",
"url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0",
"url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx",
"url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx"
}
],
"release_date": "2026-05-28T16:37:29.490000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
},
{
"cve": "CVE-2026-48710",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-26T23:01:03.204374+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481742"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The impact of this vulnerability is rated Moderate. A malformed Host header can manipulate the reconstructed request.url.path, introducing a discrepancy with the canonical ASGI request path (scope[\"path\"]). However, the vulnerability does not directly grant access, modify routing, or bypass security controls on its own. A path-based authentication or authorization bypass is possible only if an application depends on request.url.path for access control decisions rather than the canonical ASGI path or standard framework mechanisms. The impact relies heavily on downstream application design rather than a default library failure.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "RHBZ#2481742",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://badhost.org",
"url": "https://badhost.org"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
"url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
},
{
"category": "external",
"summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
},
{
"category": "external",
"summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
"url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
},
{
"category": "external",
"summary": "https://www.secwest.net/starlette",
"url": "https://www.secwest.net/starlette"
},
{
"category": "external",
"summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
}
],
"release_date": "2026-05-26T21:54:54.393000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
},
{
"cve": "CVE-2026-48746",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-06-22T23:00:57.824402+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491581"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability, residing in ASGI web servers and Starlette\u0027s trust in them, allows an attacker to bypass the OpenAI API Authentication Middleware. This bypass enables unauthorized access to the API without requiring the configured VLLM_API_KEY or --api-key, leading to critical unauthorized operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "CVE-2026-48746 is an authentication bypass in the vLLM OpenAI-compatible API server. A remote attacker who can reach the vLLM endpoint directly can craft a Host header so the authentication middleware checks a different URL path than the one actually dispatched, bypassing VLLM_API_KEY / --api-key protection. Successful exploitation allows unauthorized inference API access, which can result in confidentiality loss (model/prompt abuse) and availability impact (resource exhaustion). The flaw does not provide integrity compromise or arbitrary code execution. Exploitation requires vLLM API-key authentication to be enabled and the service to be exposed without an RFC-conforming reverse proxy that normalizes the Host header. Because Red Hat AI inference offerings are commonly deployed behind OpenShift Routes or similar proxies, and because the vulnerability is conditional on deployment and configuration, the overall flaw impact is rated Important rather than Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48746"
},
{
"category": "external",
"summary": "RHBZ#2491581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48746"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/43426",
"url": "https://github.com/vllm-project/vllm/pull/43426"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6"
},
{
"category": "external",
"summary": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette"
}
],
"release_date": "2026-06-22T21:57:28.997000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Restrict network access to the vLLM API endpoint to only trusted clients and internal networks. Implement firewall rules or network policies to limit inbound connections to the vLLM service, thereby reducing the attack surface. This operational control helps prevent unauthorized external access to the vulnerable API.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access"
},
{
"cve": "CVE-2026-48990",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-17T22:00:51.839483+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490168"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48990"
},
{
"category": "external",
"summary": "RHBZ#2490168",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490168"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48990"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/releases/tag/1.6.7",
"url": "https://github.com/authlib/joserfc/releases/tag/1.6.7"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5",
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5"
}
],
"release_date": "2026-06-17T21:08:10.534000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads"
},
{
"cve": "CVE-2026-54283",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-22T18:01:06.194658+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491440"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette where the request.form() method silently ignores configured resource limits (max_fields and max_part_size) when parsing application/x-www-form-urlencoded data. An unauthenticated attacker can exploit this by sending a urlencoded request body with an arbitrarily large number of fields or an oversized field, causing denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Starlette where the request.form() method silently ignores configured resource limits (max_fields and max_part_size) when parsing application/x-www-form-urlencoded data. An unauthenticated attacker can exploit this by sending a urlencoded request body with an arbitrarily large number of fields or an oversized field, causing denial of service through resource exhaustion. This only affects applications that explicitly call request.form() on urlencoded input; JSON-only APIs and services where Starlette is a transitive dependency not used for form parsing are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54283"
},
{
"category": "external",
"summary": "RHBZ#2491440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491440"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54283"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq"
}
],
"release_date": "2026-06-22T16:46:16.706000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS"
},
{
"cve": "CVE-2026-59939",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-08T20:02:11.756520+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498212"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial of Service (DoS) by causing the client application to run out of memory and crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `httplib2` allows a remote attacker to trigger a Denial of Service (DoS) in client applications. By sending a specially crafted, compressed HTTP response, a malicious server can cause the client to exhaust its memory due to unbounded decompression, leading to application crashes. This poses a significant risk to Red Hat products that use `httplib2` to process untrusted HTTP content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59939"
},
{
"category": "external",
"summary": "RHBZ#2498212",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498212"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59939"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59939",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59939"
},
{
"category": "external",
"summary": "https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427",
"url": "https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427"
},
{
"category": "external",
"summary": "https://github.com/httplib2/httplib2/releases/tag/v0.32.0",
"url": "https://github.com/httplib2/httplib2/releases/tag/v0.32.0"
},
{
"category": "external",
"summary": "https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3",
"url": "https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3"
}
],
"release_date": "2026-07-08T19:34:05.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies"
}
]
}
RHSA-2026:43052
Vulnerability from csaf_redhat - Published: 2026-07-21 22:47 - Updated: 2026-08-22 20:29Summary
Red Hat Security Advisory: Red Hat Quay 3.12.20
Severity
Important
Notes
Topic: Red Hat Quay 3.12.20 is now available with bug fixes.
Details: Quay 3.12.20
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
5.2 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.
8.6 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.
8.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.
7.0 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x | — |
Workaround
|
Threats
Impact
Important
References
173 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.12.20 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.12.20",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:43052",
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12143",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32591",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44486",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44487",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44488",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44492",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44494",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44495",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44990",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45822",
"url": "https://access.redhat.com/security/cve/CVE-2026-45822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43052.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.12.20",
"tracking": {
"current_release_date": "2026-08-22T20:29:40+00:00",
"generator": {
"date": "2026-08-22T20:29:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:43052",
"initial_release_date": "2026-07-21T22:47:21+00:00",
"revision_history": [
{
"date": "2026-07-21T22:47:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T20:29:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.12",
"product": {
"name": "Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.12::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1784356439"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ac3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1784355382"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Adc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784353500"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3Aeeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1784358506"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ad8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Adc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aa661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Ac766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Afe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784355757"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784354711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784353436"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Aaec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784353287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Ae74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784354521"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784353904"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"relates_to_product_reference": "Red Hat Quay 3.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64 as a component of Red Hat Quay 3.12",
"product_id": "Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64",
"relates_to_product_reference": "Red Hat Quay 3.12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-12T19:00:57.360953+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "form-data: form-data: Form field override via CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "RHBZ#2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/93.html",
"url": "https://cwe.mitre.org/data/definitions/93.html"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435",
"url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229",
"url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045",
"url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx",
"url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"
},
{
"category": "external",
"summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data",
"url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/form-data",
"url": "https://www.npmjs.com/package/form-data"
}
],
"release_date": "2026-06-12T18:01:30.362000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "form-data: form-data: Form field override via CRLF injection"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32591",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-03-12T15:09:38.210000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires the attacker to be authenticated as an organization administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "RHBZ#2446965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-44486",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:30.944384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487947"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "RHBZ#2487947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc",
"url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"
}
],
"release_date": "2026-06-11T15:39:07.714000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects"
},
{
"cve": "CVE-2026-44487",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:34.091476+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487948"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Axios affecting Node.js environments. When an application uses Axios with an authenticated HTTP proxy and follows redirects from an HTTP to a non-proxied HTTPS destination, the Proxy-Authorization header may be inadvertently sent to the final origin server. This could lead to the exposure of sensitive proxy credentials to an unintended third party.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "RHBZ#2487948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v",
"url": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v"
}
],
"release_date": "2026-06-11T15:38:25.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via redirect flows"
},
{
"cve": "CVE-2026-44488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T17:01:36.836488+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Denial of Service due to unenforced request and response size limits",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A denial of service flaw was found in Axios, a JavaScript HTTP client library. This issue arises when applications utilize the `fetch` adapter, as configured request and response size limits are not properly enforced. A remote attacker could exploit this by sending or receiving excessively large data bodies, leading to resource exhaustion and potential denial of service in affected server-side applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "RHBZ#2487949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"
}
],
"release_date": "2026-06-11T15:37:38.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Denial of Service due to unenforced request and response size limits"
},
{
"cve": "CVE-2026-44492",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-06-11T17:00:56.761751+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487938"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Axios, a JavaScript HTTP client library, that allows for a proxy bypass. When a `NO_PROXY` environment variable is configured to prevent direct connections to specific IPv4 addresses, an attacker can craft a request URL using the IPv4-mapped IPv6 address format. This bypasses the intended `NO_PROXY` exclusion, routing the request through the configured proxy and potentially exposing internal services or sensitive information, such as cloud instance metadata credentials.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "RHBZ#2487938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"release_date": "2026-06-11T15:29:13.890000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization"
},
{
"cve": "CVE-2026-44494",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:01:12.945664+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "RHBZ#2487942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh",
"url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh"
}
],
"release_date": "2026-06-11T15:32:03.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution"
},
{
"cve": "CVE-2026-44495",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:00:53.999811+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Axios, a promise-based HTTP client, can lead to information disclosure, including credential theft and response hijacking, or denial of service. Exploitation requires a separate prototype pollution vulnerability in the same JavaScript process, allowing an attacker to control `Object.prototype.transformResponse`. Red Hat products using affected Axios versions are at risk if another component introduces such pollution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "RHBZ#2487937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw"
}
],
"release_date": "2026-06-11T15:33:12.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure due to prototype pollution vulnerability"
},
{
"cve": "CVE-2026-44990",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-12T21:02:24.911971+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "RHBZ#2488565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
}
],
"release_date": "2026-06-12T20:39:47.065000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass"
},
{
"cve": "CVE-2026-45822",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-30T09:01:06.468966+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494807"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "decode-uri-component: decode-uri-component: Denial of Service via crafted input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial of service flaw was found in the decode-uri-component npm package. The decode() function exhibits super-linear time complexity when processing input containing many percent-encoded sequences, allowing an attacker to cause significant CPU consumption and event-loop blocking. In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation. Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA\u0027s CVSS 4.0 assessment of 6.6 Medium.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45822"
},
{
"category": "external",
"summary": "RHBZ#2494807",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494807"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45822"
},
{
"category": "external",
"summary": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js",
"url": "https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js"
},
{
"category": "external",
"summary": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005",
"url": "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/decode-uri-component",
"url": "https://www.npmjs.com/package/decode-uri-component"
}
],
"release_date": "2026-06-30T08:05:36.399000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Validate and limit the length of any user-controlled input before passing it to decode-uri-component\u0027s decode() function. Inputs containing more than approximately 200 percent-encoded tokens (e.g. \u0027%ab\u0027 sequences) can trigger noticeable delays. Reject or truncate URI components exceeding a reasonable length threshold before decoding. A fix exists in the upstream repository (commit fa479daf) but has not yet been included in an npm release.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "decode-uri-component: decode-uri-component: Denial of Service via crafted input"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:47:21+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:45d4574f48633e9f3c8495dc9301cf9e763f34dcf6a357d6d5cb94ec5e2457b9_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:468142f734967c9b0b4f894b0e085e8b6abc5bfa5e5e2283fa39bab589169adf_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:4db81a2e6fabf71b0b149e91cb75048f1898a58d3e494ce640c4815374342c86_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/clair-rhel8@sha256:aec2352526422a9254171e5315c7c9de030473565a90008c8ca4a512acfc7ad1_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:2ceea217c5db3618477887fbaa03e8f8c50c12192490fa59141c7e53cc020601_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1f36419d267f0ebf8cfe2bc44b39310dffa4a6a76797325def110d659ddad569_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:5bd43bf7fc303c4a17b701d76b7af74e02626692b364bd2ee203a9c0040a2b38_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d8faf0239f64f26c540ce37c07cc0a60fca0714820f9a7d18962efe7e29c0591_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:dc2972f26626a1492d1294c791f4446b9357a0b905efdff753d14b5a606f0f10_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4867f2014f183d9113320d7ac32ff75f0eeae74a8a70f23e85c71bce7308b789_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:058a23bd8c03725bc20e1a9c14bbb8703c4d8ed048e6e7e73d801d30855d22d8_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:35d52a9b80c2fe7ce44c0432f6978c46221481c2564c57e52a13bc641aea6c40_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:86b37be69324dbf1ff1cbb6466cc4af1af1e447f95bd92c3fed291228869e3ab_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-builder-rhel8@sha256:dc823f4e764ea5849a3f7a9f13e87aea9126fe71e71edf6e2eb66641b7099c3d_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:007e613b5b6b22468ad411bb6c86b2746c5a32940edec08d9eb4e921464a7fff_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:881c3b07135e3b58a87dd594f5938a2125031cdf646152362882ec62a4c4376c_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8f4894e944ec2632c815f9d5e342aadeb6b3a3755f12f1398936af8b769f099c_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3a0eb125dbce20eba957cab3865e6315eb8a33048073f69e7e1ec1869deec5c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fe72115213b1439fa0d309b915276f711c5722cbbfc36a17c121b5cff7420a19_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-bundle@sha256:eeb44c917a431bf0aa7767ae5fc91f11dd81ee0ee3e520ad75e2b8e173bcf070_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:30f9fbbeced4531778c57025b196034a030b67d7b974ffd429e006684b90393c_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:a661e9a46ab33f04a7036faa3a395050cc74fd37a1fbd828fa6a781698f40a22_arm64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:ba7fa3bc25063653e47bffa117978b1eb8a29a6941e5556ebc579c5b6d46ddcd_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-operator-rhel8@sha256:e74476a507c77f2bf58149dc90b564d868da097e2d92b2abebb2f60f1fd0dd5e_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:66afc63628c46fd5487f36bbad8832c6acf8e7da6b28b826b618a3fd8086fd90_amd64",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a1447de1fcb5899d43d7598e2bd25e089c08b5d204ca1ffd8bfef1a85044c76c_ppc64le",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:a91dc54908b3c6f6fad385060c208942634f4989518a711c62958317cb4f3bbd_s390x",
"Red Hat Quay 3.12:registry.redhat.io/quay/quay-rhel8@sha256:c766e6c1f1947d1baf8cb2b02dea6f50606858e78405e465e8decd2f5eabbbf8_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
}
]
}
RHSA-2026:43692
Vulnerability from csaf_redhat - Published: 2026-07-22 15:57 - Updated: 2026-08-22 22:14Summary
Red Hat Security Advisory: Red Hat OpenShift API for Data Protection
Severity
Important
Notes
Topic: A new version of OpenShift API for Data Protection (OADP) is now available.
Details: OpenShift API for Data Protection (OADP) enables you to back up and restore
application resources, persistent volume data, and internal container
images to external backup storage. OADP enables both file system-based and
snapshot-based backups for persistent volumes.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Moderate
A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an unexpected message type, which the client code does not handle, leading to panic("unreachable") or a nil-pointer dereference. A malicious agent or forwarded connection can exploit this to terminate the client process.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the SSH Agent servers component (golang.org/x/crypto/ssh/agent). This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a specially crafted, malformed message during new identity requests. The server fails to validate the size of these messages, leading to an out-of-bounds read that can cause the program to panic and terminate.
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. An attacker can exploit this vulnerability by sending specially crafted GSSAPI (Generic Security Service Application Program Interface) authentication requests to an SSH (Secure Shell) server. The server fails to validate the number of mechanisms specified in these requests, leading to unbounded memory consumption. This can result in a Denial of Service (DoS), making the SSH server unavailable to legitimate users.
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Moderate
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) in an exposed go application if an attacker provides specially crafted HTML content.
4.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition, making the system unavailable to legitimate users.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Moderate
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user's browser.
5.4 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user's browser.
5.4 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the server process and affecting all connected users.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.
5.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely, continuously sending empty packets without making progress. The primary consequence is a denial of service (DoS), as the affected system consumes resources and prevents legitimate data transfer.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit an integer underflow and an out-of-bounds read vulnerability by calling `gss_accept_sec_context()` on a system with a NegoEx mechanism registered. This can lead to the process terminating, resulting in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.
6.1 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/html. When parsing arbitrary HTML that is subsequently rendered, an unexpected HTML tree can be generated. A remote attacker could leverage this vulnerability to execute Cross-Site Scripting (XSS) attacks in applications that attempt to sanitize input HTML before rendering, potentially leading to unauthorized actions or information disclosure.
5.4 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cause the program to panic and crash, resulting in a Denial of Service (DoS) for the affected component.
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
66 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
284 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of OpenShift API for Data Protection (OADP) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift API for Data Protection (OADP) enables you to back up and restore\napplication resources, persistent volume data, and internal container\nimages to external backup storage. OADP enables both file system-based and\nsnapshot-based backups for persistent volumes.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:43692",
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-47911",
"url": "https://access.redhat.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-47913",
"url": "https://access.redhat.com/security/cve/CVE-2025-47913"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-47914",
"url": "https://access.redhat.com/security/cve/CVE-2025-47914"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-58181",
"url": "https://access.redhat.com/security/cve/CVE-2025-58181"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-58190",
"url": "https://access.redhat.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25680",
"url": "https://access.redhat.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33814",
"url": "https://access.redhat.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39817",
"url": "https://access.redhat.com/security/cve/CVE-2026-39817"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39823",
"url": "https://access.redhat.com/security/cve/CVE-2026-39823"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39825",
"url": "https://access.redhat.com/security/cve/CVE-2026-39825"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39826",
"url": "https://access.redhat.com/security/cve/CVE-2026-39826"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39827",
"url": "https://access.redhat.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39831",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39833",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39834",
"url": "https://access.redhat.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40356",
"url": "https://access.redhat.com/security/cve/CVE-2026-40356"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42502",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42506",
"url": "https://access.redhat.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46598",
"url": "https://access.redhat.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43692.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift API for Data Protection",
"tracking": {
"current_release_date": "2026-08-22T22:14:30+00:00",
"generator": {
"date": "2026-08-22T22:14:30+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:43692",
"initial_release_date": "2026-07-22T15:57:51+00:00",
"revision_history": [
{
"date": "2026-07-22T15:57:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T22:14:30+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift API for Data Protection 1.6",
"product": {
"name": "OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_api_data_protection:1.6::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift API for Data Protection"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1784059134"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3A9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1784058832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-controller-rhel9@sha256%3A0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9\u0026tag=1784058953"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-plugin-rhel9@sha256%3A5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9\u0026tag=1784058704"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1784058446"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1784058949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3A0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1784059055"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1784059086"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"product_id": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-operator-bundle@sha256%3A1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-operator-bundle\u0026tag=1784060839"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1784058822"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1784058872"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1784058666"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Ac9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1784058364"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3Ae3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1784058385"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1784059058"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"product_id": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vm-file-restore-rhel9@sha256%3Ac1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-vm-file-restore-rhel9\u0026tag=1784058431"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"product_id": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmdp-binaries-rhel9@sha256%3A8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9\u0026tag=1784059187"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"product_id": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmfr-access-rhel9@sha256%3A14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-vmfr-access-rhel9\u0026tag=1784059129"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"product_id": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmfr-access-filebrowser-rhel9@sha256%3Ae6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9\u0026tag=1784058355"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"product_id": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmfr-access-sshd-rhel9@sha256%3A6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9\u0026tag=1784058384"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3Aa5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1784059134"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3Acc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1784058832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-controller-rhel9@sha256%3A2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9\u0026tag=1784058953"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-plugin-rhel9@sha256%3A7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9\u0026tag=1784058704"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Ab209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1784058446"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1784058949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3A92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1784059055"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3Ad7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1784059086"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1784058822"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3Ac5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1784058872"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1784058666"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Ab2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1784058364"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3A4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1784058385"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3Addbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1784059058"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"product_id": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vm-file-restore-rhel9@sha256%3Acee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-vm-file-restore-rhel9\u0026tag=1784058431"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"product_id": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmdp-binaries-rhel9@sha256%3A7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9\u0026tag=1784059187"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"product_id": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmfr-access-rhel9@sha256%3A759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-vmfr-access-rhel9\u0026tag=1784059129"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"product_id": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmfr-access-filebrowser-rhel9@sha256%3A41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9\u0026tag=1784058355"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64",
"product_id": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmfr-access-sshd-rhel9@sha256%3A88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9\u0026tag=1784058384"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3Af004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1784059134"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3A6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1784058832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-controller-rhel9@sha256%3Ac2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9\u0026tag=1784058953"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-plugin-rhel9@sha256%3Ab533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9\u0026tag=1784058704"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Ab15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1784058446"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1784058949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3A8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1784059055"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1784059086"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3Ae3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1784058822"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1784058872"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1784058666"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1784058364"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3Ac14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1784058385"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1784059058"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"product_id": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmdp-binaries-rhel9@sha256%3A8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9\u0026tag=1784059187"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"product_id": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmfr-access-rhel9@sha256%3A9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-vmfr-access-rhel9\u0026tag=1784059129"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1784059134"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3A7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1784058832"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-controller-rhel9@sha256%3A5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9\u0026tag=1784058953"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-datamover-plugin-rhel9@sha256%3Af723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9\u0026tag=1784058704"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1784058446"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3Ab78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1784058949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3A7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1784059055"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1784059086"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3Afdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1784058822"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1784058872"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1784058666"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Ac2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1784058364"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3Ae659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1784058385"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1784059058"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-vmdp-binaries-rhel9@sha256%3Afe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9\u0026tag=1784059187"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64 as a component of OpenShift API for Data Protection 1.6",
"product_id": "OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-47911",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-02-05T18:01:23.423406+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437109"
}
],
"notes": [
{
"category": "description",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: The `golang.org/x/net/html` package, used across various Red Hat products, is vulnerable to a denial of service due to quadratic parsing complexity in its `html.Parse` function. An attacker providing specially crafted HTML content could exploit this flaw, leading to resource exhaustion and service unavailability in applications that process untrusted HTML input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "RHBZ#2437109",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437109"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-47911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47911"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4440",
"url": "https://github.com/golang/vulndb/issues/4440"
},
{
"category": "external",
"summary": "https://go.dev/cl/709876",
"url": "https://go.dev/cl/709876"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c",
"url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4440",
"url": "https://pkg.go.dev/vuln/GO-2026-4440"
}
],
"release_date": "2026-02-05T17:48:44.562000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html"
},
{
"cve": "CVE-2025-47913",
"discovery_date": "2025-11-13T22:01:26.092452+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2414943"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an unexpected message type, which the client code does not handle, leading to panic(\"unreachable\") or a nil-pointer dereference. A malicious agent or forwarded connection can exploit this to terminate the client process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability was marked as Important because it allows any malicious or misbehaving SSH agent to force a crash in the client process using a single valid protocol byte. The panic occurs before the client has a chance to validate message structure or recover, which means an attacker controlling\u2014or intercepting\u2014SSH agent traffic can reliably terminate processes that rely on agent interactions. In environments where SSH agents operate over forwarded sockets, shared workspaces, or CI/CD runners, this turns into a reliable, unauthenticated remote denial of service against critical automation or developer tooling. The flaw also stems from unsafe assumptions in the unmarshalling logic, where unexpected but protocol-legal message types drop into \u201cunreachable\u201d code paths instead of being handled gracefully\u2014making it a design-level reliability break rather than a simple error-handling bug. For this reason, it is rated as an important availability-impacting vulnerability rather than a moderate issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-47913"
},
{
"category": "external",
"summary": "RHBZ#2414943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414943"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-47913",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47913"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47913",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47913"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-hcg3-q754-cr77",
"url": "https://github.com/advisories/GHSA-hcg3-q754-cr77"
},
{
"category": "external",
"summary": "https://go.dev/cl/700295",
"url": "https://go.dev/cl/700295"
},
{
"category": "external",
"summary": "https://go.dev/issue/75178",
"url": "https://go.dev/issue/75178"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4116",
"url": "https://pkg.go.dev/vuln/GO-2025-4116"
}
],
"release_date": "2025-11-13T21:29:39.907000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
},
{
"cve": "CVE-2025-47914",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-11-19T21:01:06.202641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416000"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SSH Agent servers component (golang.org/x/crypto/ssh/agent). This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a specially crafted, malformed message during new identity requests. The server fails to validate the size of these messages, leading to an out-of-bounds read that can cause the program to panic and terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. The golang.org/x/crypto/ssh/agent library, when used in SSH Agent servers, does not properly validate the size of messages during new identity requests. A specially crafted malformed message can lead to an out-of-bounds read, causing the program to panic and resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-47914"
},
{
"category": "external",
"summary": "RHBZ#2416000",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416000"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-47914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47914"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47914",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47914"
},
{
"category": "external",
"summary": "https://go.dev/cl/721960",
"url": "https://go.dev/cl/721960"
},
{
"category": "external",
"summary": "https://go.dev/issue/76364",
"url": "https://go.dev/issue/76364"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA",
"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4135",
"url": "https://pkg.go.dev/vuln/GO-2025-4135"
}
],
"release_date": "2025-11-19T20:33:43.126000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages"
},
{
"cve": "CVE-2025-58181",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-11-19T21:00:50.197590+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2415997"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. An attacker can exploit this vulnerability by sending specially crafted GSSAPI (Generic Security Service Application Program Interface) authentication requests to an SSH (Secure Shell) server. The server fails to validate the number of mechanisms specified in these requests, leading to unbounded memory consumption. This can result in a Denial of Service (DoS), making the SSH server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. SSH servers utilizing `golang.org/x/crypto/ssh` and configured to process GSSAPI authentication requests are susceptible to unbounded memory consumption. An attacker can exploit this by sending specially crafted GSSAPI authentication requests, potentially leading to a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-58181"
},
{
"category": "external",
"summary": "RHBZ#2415997",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415997"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-58181",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58181"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58181",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58181"
},
{
"category": "external",
"summary": "https://go.dev/cl/721961",
"url": "https://go.dev/cl/721961"
},
{
"category": "external",
"summary": "https://go.dev/issue/76363",
"url": "https://go.dev/issue/76363"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA",
"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4134",
"url": "https://pkg.go.dev/vuln/GO-2025-4134"
}
],
"release_date": "2025-11-19T20:33:42.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication"
},
{
"cve": "CVE-2025-58190",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-02-05T18:01:26.511908+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437110"
}
],
"notes": [
{
"category": "description",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) in an exposed go application if an attacker provides specially crafted HTML content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: Infinite parsing loop in golang.org/x/net",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "RHBZ#2437110",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437110"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-58190",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58190"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58190",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58190"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4441",
"url": "https://github.com/golang/vulndb/issues/4441"
},
{
"category": "external",
"summary": "https://go.dev/cl/709875",
"url": "https://go.dev/cl/709875"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c",
"url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4441",
"url": "https://pkg.go.dev/vuln/GO-2026-4441"
}
],
"release_date": "2026-02-05T17:48:44.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: Infinite parsing loop in golang.org/x/net"
},
{
"cve": "CVE-2026-25680",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-05-22T16:01:05.431197+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480760"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition, making the system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Moderate with RH CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). A flaw was found in golang.org/x/net/html where parsing crafted HTML can consume excessive CPU time, leading to denial of service. Exploitation requires user interaction (a victim application parsing attacker-controlled HTML). Most Red Hat products that bundle golang.org/x/net do not use the html parser to process untrusted HTML in their supported execution paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "RHBZ#2480760",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480760"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25680"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25680",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25680"
},
{
"category": "external",
"summary": "https://go.dev/cl/781702",
"url": "https://go.dev/cl/781702"
},
{
"category": "external",
"summary": "https://go.dev/issue/79573",
"url": "https://go.dev/issue/79573"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5028",
"url": "https://pkg.go.dev/vuln/GO-2026-5028"
}
],
"release_date": "2026-05-22T15:01:21.805000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse untrusted HTML content, or enforce timeouts on HTML parsing operations. Applications that do not parse arbitrary HTML are not affected.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing"
},
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-33814",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:11.324941+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in the Go HTTP/2 protocol implementation allows a remote, unauthenticated attacker to exhaust system resources. By sending a specially crafted HTTP/2 SETTINGS frame with a zero-value SETTINGS_MAX_FRAME_SIZE, the vulnerable Go library enters an infinite loop, impacting the availability of services utilizing HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "RHBZ#2467815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33814"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814"
},
{
"category": "external",
"summary": "https://go.dev/cl/761581",
"url": "https://go.dev/cl/761581"
},
{
"category": "external",
"summary": "https://go.dev/cl/761640",
"url": "https://go.dev/cl/761640"
},
{
"category": "external",
"summary": "https://go.dev/issue/78476",
"url": "https://go.dev/issue/78476"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4918",
"url": "https://pkg.go.dev/vuln/GO-2026-4918"
}
],
"release_date": "2026-05-07T19:41:17.631000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
},
{
"cve": "CVE-2026-39817",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-07T20:01:43.510043+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the \"go tool pack\" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the \"pack\" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39817"
},
{
"category": "external",
"summary": "RHBZ#2467825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39817"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817"
},
{
"category": "external",
"summary": "https://go.dev/cl/767520",
"url": "https://go.dev/cl/767520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78778",
"url": "https://go.dev/issue/78778"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4979",
"url": "https://pkg.go.dev/vuln/GO-2026-4979"
}
],
"release_date": "2026-05-07T19:41:18.993000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39823",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-07T20:00:58.284024+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467811"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL\u0027s content attribute inside a `\u003cmeta\u003e` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship the Go `html/template` package as a dependency of various Go-based components. The affected functionality involves URL escaping inside `\u003cmeta\u003e` tag content attributes, which requires an application to render user-controlled URLs in meta tags using `html/template`. While the vulnerable code is present, exploitation requires a specific usage pattern that is uncommon in Red Hat product code paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39823"
},
{
"category": "external",
"summary": "RHBZ#2467811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467811"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39823"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823"
},
{
"category": "external",
"summary": "https://go.dev/cl/769920",
"url": "https://go.dev/cl/769920"
},
{
"category": "external",
"summary": "https://go.dev/issue/78913",
"url": "https://go.dev/issue/78913"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4982",
"url": "https://pkg.go.dev/vuln/GO-2026-4982"
}
],
"release_date": "2026-05-07T19:41:19.524000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Ensure that user-supplied URLs are validated and sanitized before being passed to Go\u0027s `html/template` package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content"
},
{
"cve": "CVE-2026-39825",
"cwe": {
"id": "CWE-472",
"name": "External Control of Assumed-Immutable Web Parameter"
},
"discovery_date": "2026-05-07T20:01:37.714133+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467823"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s net/http/httputil package where ReverseProxy can forward query parameters that are hidden from Rewrite or Director functions. This occurs when the number of query parameters exceeds the url.ParseQuery limit (controlled by the GODEBUG setting urlmaxqueryparams). While Red Hat ships Go-based components across many products, exploitation requires that an application use ReverseProxy with a Rewrite or Director function that relies on query parameter inspection for security enforcement, which limits the practical impact of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39825"
},
{
"category": "external",
"summary": "RHBZ#2467823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467823"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39825"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825"
},
{
"category": "external",
"summary": "https://go.dev/cl/770541",
"url": "https://go.dev/cl/770541"
},
{
"category": "external",
"summary": "https://go.dev/issue/78948",
"url": "https://go.dev/issue/78948"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4976",
"url": "https://pkg.go.dev/vuln/GO-2026-4976"
}
],
"release_date": "2026-05-07T19:41:18.453000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy\u0027s Rewrite or Director function for security filtering.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls"
},
{
"cve": "CVE-2026-39826",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-07T20:01:46.305827+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467826"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only \u0027type\u0027 attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39826"
},
{
"category": "external",
"summary": "RHBZ#2467826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467826"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39826"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826"
},
{
"category": "external",
"summary": "https://go.dev/cl/771180",
"url": "https://go.dev/cl/771180"
},
{
"category": "external",
"summary": "https://go.dev/issue/78981",
"url": "https://go.dev/issue/78981"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4980",
"url": "https://pkg.go.dev/vuln/GO-2026-4980"
}
],
"release_date": "2026-05-07T19:41:19.138000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping"
},
{
"cve": "CVE-2026-39827",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:32.990556+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480682"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the server process and affecting all connected users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "RHBZ#2480682",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480682"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39827"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39827",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39827"
},
{
"category": "external",
"summary": "https://go.dev/cl/781320",
"url": "https://go.dev/cl/781320"
},
{
"category": "external",
"summary": "https://go.dev/issue/35127",
"url": "https://go.dev/issue/35127"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5016",
"url": "https://pkg.go.dev/vuln/GO-2026-5016"
}
],
"release_date": "2026-05-22T02:31:27.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39831",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-22T04:01:12.861178+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "RHBZ#2480675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://go.dev/cl/781662",
"url": "https://go.dev/cl/781662"
},
{
"category": "external",
"summary": "https://go.dev/issue/79566",
"url": "https://go.dev/issue/79566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5019",
"url": "https://pkg.go.dev/vuln/GO-2026-5019"
}
],
"release_date": "2026-05-22T02:31:27.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39833",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-05-22T04:01:35.714593+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480683"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Moderate with RH CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). A flaw was found in golang.org/x/crypto/ssh/agent where the in-memory keyring returned by NewKeyring() silently accepted SSH agent keys with the ConfirmBeforeUse constraint but did not enforce interactive confirmation before signing. Exploitation requires local access and low privileges on a system where an affected application uses NewKeyring() with ConfirmBeforeUse. Most Red Hat products that bundle golang.org/x/crypto do not use the ssh/agent ConfirmBeforeUse feature in their supported execution paths. The upstream CISA CVSS 9.1 assumes a broader network attack context that does not reflect Red Hat product deployment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "RHBZ#2480683",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480683"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://go.dev/cl/778640",
"url": "https://go.dev/cl/778640"
},
{
"category": "external",
"summary": "https://go.dev/cl/778641",
"url": "https://go.dev/cl/778641"
},
{
"category": "external",
"summary": "https://go.dev/issue/79436",
"url": "https://go.dev/issue/79436"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5005",
"url": "https://pkg.go.dev/vuln/GO-2026-5005"
}
],
"release_date": "2026-05-22T02:31:26.294000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation"
},
{
"cve": "CVE-2026-39834",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-22T04:01:15.681060+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480676"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely, continuously sending empty packets without making progress. The primary consequence is a denial of service (DoS), as the affected system consumes resources and prevents legitimate data transfer.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "RHBZ#2480676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480676"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39834"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39834",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39834"
},
{
"category": "external",
"summary": "https://go.dev/cl/781663",
"url": "https://go.dev/cl/781663"
},
{
"category": "external",
"summary": "https://go.dev/issue/79567",
"url": "https://go.dev/issue/79567"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5020",
"url": "https://pkg.go.dev/vuln/GO-2026-5020"
}
],
"release_date": "2026-05-22T02:31:27.540000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-40356",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-04-28T07:01:37.543641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit an integer underflow and an out-of-bounds read vulnerability by calling `gss_accept_sec_context()` on a system with a NegoEx mechanism registered. This can lead to the process terminating, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact denial of service flaw in MIT Kerberos 5 (krb5) allows an unauthenticated remote attacker to trigger an integer underflow and out-of-bounds read. This vulnerability, which can lead to process termination, specifically affects systems where the NegoEx mechanism is registered and `gss_accept_sec_context()` is called. While Kerberos is a fundamental service, the prerequisite of a registered NegoEx mechanism limits the attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40356"
},
{
"category": "external",
"summary": "RHBZ#2463368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356"
},
{
"category": "external",
"summary": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html",
"url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
},
{
"category": "external",
"summary": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f",
"url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
},
{
"category": "external",
"summary": "https://web.mit.edu/kerberos/advisories/",
"url": "https://web.mit.edu/kerberos/advisories/"
}
],
"release_date": "2026-04-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the NegoEx mechanism is not registered in the `/etc/gss/mech` configuration file. Removing the corresponding entry from this file will prevent the vulnerable code path from being activated. This action may impact services that rely on the NegoEx GSS-API mechanism. A restart of affected Kerberos-dependent services may be required for the change to take effect.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42502",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:11.151484+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480762"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "RHBZ#2480762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://go.dev/cl/781701",
"url": "https://go.dev/cl/781701"
},
{
"category": "external",
"summary": "https://go.dev/issue/79572",
"url": "https://go.dev/issue/79572"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5027",
"url": "https://pkg.go.dev/vuln/GO-2026-5027"
}
],
"release_date": "2026-05-22T15:01:21.649000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
},
{
"cve": "CVE-2026-42506",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:02.675281+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When parsing arbitrary HTML that is subsequently rendered, an unexpected HTML tree can be generated. A remote attacker could leverage this vulnerability to execute Cross-Site Scripting (XSS) attacks in applications that attempt to sanitize input HTML before rendering, potentially leading to unauthorized actions or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in `golang.org/x/net/html` can lead to Cross-Site Scripting (XSS) in applications that process and render untrusted HTML, even when input sanitization is implemented. The vulnerability arises from an unexpected HTML tree structure generated during parsing, potentially allowing a remote attacker to execute arbitrary script code in the user\u0027s browser, leading to information disclosure or unauthorized actions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "RHBZ#2480759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42506"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42506",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42506"
},
{
"category": "external",
"summary": "https://go.dev/cl/781700",
"url": "https://go.dev/cl/781700"
},
{
"category": "external",
"summary": "https://go.dev/issue/79571",
"url": "https://go.dev/issue/79571"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5025",
"url": "https://pkg.go.dev/vuln/GO-2026-5025"
}
],
"release_date": "2026-05-22T15:01:21.056000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse and re-render untrusted HTML content. Applications that do not parse arbitrary HTML are not affected.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
},
{
"cve": "CVE-2026-46598",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-05-22T04:01:24.490498+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480679"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cause the program to panic and crash, resulting in a Denial of Service (DoS) for the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate denial of service flaw exists in the `golang.org/x/crypto/ssh/agent` package. This vulnerability allows an attacker to provide specially crafted inputs that, when processed by the SSH agent, can lead to a program panic and crash. This could result in a temporary disruption of services that rely on the affected SSH agent functionality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "RHBZ#2480679",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480679"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46598"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46598",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46598"
},
{
"category": "external",
"summary": "https://go.dev/cl/781360",
"url": "https://go.dev/cl/781360"
},
{
"category": "external",
"summary": "https://go.dev/issue/79596",
"url": "https://go.dev/issue/79596"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5033",
"url": "https://pkg.go.dev/vuln/GO-2026-5033"
}
],
"release_date": "2026-05-22T02:31:27.986000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-22T15:57:51+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the exposure of the SSH agent to untrusted sources. Avoid enabling SSH agent forwarding when connecting to untrusted hosts or environments. Ensure that applications interacting with `golang.org/x/crypto/ssh/agent` validate all inputs to prevent malformed data from being processed. Reloading or restarting SSH services may be required for changes to take effect.",
"product_ids": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:7ddc295bfa28d274fa8cb25c08a5646cd3c73f4e373e879c4729e5dce2c1a2ef_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:a5e4b9c4324114ef3de7ffe75736fa267e8f05b1198e3014475b93b0d2a0b945_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:f004c6f3d3c31329ccf40d62a83d72490b73d555950173ea43e7cf07532653c5_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:6de24aac166b8772fdb7918571696bf074a588267bda0835593c1b9f5e4df704_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:7aab17881b9df52b5c7420b9d6c79912ce1f71c47bf9110cfbd650d6cf6fd339_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:9d44953f858d33aa4b49433eaaf267d56549e91e3f75454c42ea20bd68b558b8_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:cc9b31528ec928edae14485f74955833aa75b486c488a62b7fcc14c65d73723f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:0cd6baa9a55d0ba2c90d8e7b416cf4ceb1116bd2533b754a72f0f38ccea4901e_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:2348e3691e7c8edc74411af0352536c2d3aa7cff8ce79ea1dd4403af19dd08f7_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:5be20f5d5b35476c17fa8a5edfde8956092f25727ac35fc69d188350644ce3a2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-controller-rhel9@sha256:c2a4be3d64ecb93958479b07767957632da0390873604bf263bfca4c979bae85_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:5fbc3a3bf357c1b274833a30595deda79080e41758b331f4c8632b656f87d9e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:7c3897d545904e1ed41cdbfb57db667c0c18f67347d086177a89b2ecf4d74c74_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:b533a0d9eb71a350cfb7690e35248b074b86be8b23f87fb1aca8561365d93288_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-datamover-plugin-rhel9@sha256:f723efa2747af15cb9ab2d636e9c2784c817dd5f77aa0f019fe78d54d3bac13f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:77b8164d79c81b2c3c73ae2407aaab59415ffc58a64020875e94455af13fee3a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:95bb0095ab17e83f5ef0277fc0936d4954b0b2f3f031af43f74c39c01a9fc2ab_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b15e717372414b903cc478a962d36993d7b5bdbf52abf224448e150906f6fc18_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:b209265c88567b1c81727d7fcfe500c9c14c0822d83dfd0c13695388cdbece81_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:3f005d4e87ef8b4b19b21f3fc3cf8a2dd0afd8a8778b3274c0a0552a9c0ad256_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:523ab671f0c099798f60919c87b2e5215fb65d71f3b677e2096ed12d6c25ce36_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:7b9c66c952ff3b1e246927be7fd083bb37eeba4d3e53d2b53a648b4f7fe7064f_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b78935df05642d604919f0022cd3aa5898bc42a545f5827811e5b58035f2809c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:0581a5d243f65fc6d060802b31953faebe3c9bbd923755d672012f6c32c53168_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:7e27521f062cff1c65a064dc01adef8b88a14acdfd72c3594adf28a9e7651cfa_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:8ad67453e34addf49fbdf3c7ff09a2b3d4120241748c59c1afeca5138fe7b9ba_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:92a7330d9118513d72da01e99456cc6c49e7850909c50e191566b935da6b9f68_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-operator-bundle@sha256:1ff9c955b2b9842d0a7e57666c545ff68d35b36a202786df6f94e9653b9cce10_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0443a738e0dc32182ea97b6bb84ccf48289ce081bad5b0c419e4365d597c5ca0_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:56b20bc99ae167d96fb307c8be5dd2c22c19ca02015cc7ae823289089ca57524_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:9b76270cba67042991d7626b7e35f5903b9c1154ac8ccccaeb5a0ddeba31eac9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:d7b888697cb18c3911a36e76dd485402570123adadea82c44db495ec12d00e73_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4e7c7af49c430cab3eb7cc93de737bae7887f620d030432cb69ba2506d2c320c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:595ab0daa19884114d3efc5a9d47e5d937586d941cd52963f61bb1ead0e15243_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:6523cc3badba39edd5ae3aa86b774855ac18f228630ac264502be1ea9c9e1edc_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7f4124da40cc5a303d91e6cfe10328ce51873b7f63009519fed1f3e005b00f4a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:85e0a597876742d035720877f54211c932e5eccfccde432d3d7f534d67025ea3_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:b2a721db67e21a2e5ebbc36495ee60ffef943839706bf27670bc9044fafc9351_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c2a5bac58af2070feac2ce23a1215e12ea47ad8d080d7a37fa775e5c569d99c2_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c9e86e026c6178d0d14b3b493ed3da5c082c542ce912116d6c6ffe485f672658_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:4af8e092ac515f7b6219b2ed2d8fee6f9e66f4d95c1be6f6ba544366f3742eb9_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:c14f1329cfad3cbff78686daeb8ad0e3a0459981847dc46745e70db8adee1c08_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e3d48d0cfcd0a2e737d263af21ff15091f610f7eaec48e1f642e0b7ee51b9ef4_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:e659d3df31bf2f556f29e95c480cc3c263c295e5cf062f9cfce9f0c0f274519c_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1e6003cb865c83854fef387ef67d6f123a7116d57ccb1a89a5a4bc2e5881760b_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:367c1427caeb727d7298f17412e612b7f4caafd3be77b3b51083ce120554236e_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:5984ce138b1491baff91971663df8c6387388381d8edd455b8c771b69ee707f9_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ddbe19ffc5731e1ad8dacf537752bb9e612cf8786bc95711a24b25a1e4921f3a_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5378ff365d367d9e6ca14a8d81fe4e2a64a3392d31c494d85d231b8b7df5845c_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:64a629f87f78447b6df09caa79cca73e53655e4b1ac4e51116056c6663a6fbf6_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:912b31254e58d977c5448c7b7d5a723d8e62a377bb5b69ac5d8d6101f7d335f3_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c5c37de91467fbd4319dd667a8528c6f45b198a1323e23e6536e76397336b25d_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1a9757e2badab0d1ca54c5ac7f058ff7cdb64c1b2837f0f9559f3545eaf5f709_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4da545acd9a8615d51fcc8c014599ab4df309ee412eee1403f4f8b1472e92803_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:e3acf1706978b91bf6a1bfcbaaf5b0e380a6e56f59a5fc232400228697379c87_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:fdcb05809e9f385b137701487fab4926e99543f37552af5d62ebd54766c8c688_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:c1a62d06a25dc13020fffb1431ab248a8e0fd23455c10b9fa500f35f38c0a24d_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vm-file-restore-rhel9@sha256:cee5df45839981e5a537df2266d90b3b56edf855d7058706c4f6a603db4136e3_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:7495259636ae75980f52bbba531083d019a0ba4d33ab4ccf19e0beb2a18e0776_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8c670e9f442f576c765e0859fb52540565a779420b0d9c5a6ea75bc2149ac8e5_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:8de0eac6a6a60878745fc33ddb4420b26b25a0524a5b98a1a7d05942502acfd9_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmdp-binaries-rhel9@sha256:fe742395e18ceef92eb11cf1eadc119c693cbcfd0ac986a3b82dd65f3613ac7f_ppc64le",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:41f92f33d1e6df63305ce1207124a9a205632e61aa2e866f97430e66978a4424_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-filebrowser-rhel9@sha256:e6b8594ec7b8e47edee5eabc7b3097f49c442cb0c208a5f388d0891b612d4e2a_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:14b95c56b17519fac217d787a9c5de798f3e97dabb0d5845e7d1006d037b65fe_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:759640af7be9d53378c051fafc4592cee9f1a6d442594e67aacee0c514cb6730_arm64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-rhel9@sha256:9d41e8017f164f2be0f3d3a43479b312a9f5816342e5d0d94ef2d68f3aa94727_s390x",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:6a9af4e0c9264b0a954e7d449c8792a36c6f95d8a89f14d426c999167429e313_amd64",
"OpenShift API for Data Protection 1.6:registry.redhat.io/oadp/oadp-vmfr-access-sshd-rhel9@sha256:88e43a16ba6d2af68816230bdcc7bd701fa697dcb1ba7c47feb3e014725b250e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input"
}
]
}
RHSA-2026:47952
Vulnerability from csaf_redhat - Published: 2026-07-29 14:47 - Updated: 2026-08-22 22:14Summary
Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.12
Severity
Important
Notes
Topic: Logging for Red Hat OpenShift - 6.2.12
Details: Red Hat OpenShift Logging 6.2.12 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Vendor Fix
fix
|
Known not affected
22 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
22 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 | — |
Workaround
|
Threats
Impact
Important
References
126 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Logging for Red Hat OpenShift - 6.2.12",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Logging 6.2.12 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:47952",
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47952.json"
}
],
"title": "Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.12",
"tracking": {
"current_release_date": "2026-08-22T22:14:41+00:00",
"generator": {
"date": "2026-08-22T22:14:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:47952",
"initial_release_date": "2026-07-29T14:47:37+00:00",
"revision_history": [
{
"date": "2026-07-29T14:47:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-22T06:15:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T22:14:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Logging Subsystem for Red Hat OpenShift 6.2",
"product": {
"name": "Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:logging:6.2::el9"
}
}
}
],
"category": "product_family",
"name": "Logging Subsystem for Red Hat OpenShift"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1784833274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-operator-bundle@sha256%3A47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=1784836825"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1784747813"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1784747805"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3Aa80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1784748010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Ae2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1784747884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-operator-bundle@sha256%3A99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-operator-bundle\u0026tag=1784751438"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Aae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1784747816"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Ac89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1784747815"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1784833657"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1784833274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1784747813"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1784747805"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1784748010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1784747884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Ab81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1784747816"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3A134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1784747815"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1784833657"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1784833274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1784747813"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Acc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1784747805"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1784748010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1784747884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1784747816"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3A22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1784747815"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1784833657"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1784833274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1784747813"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1784747805"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1784748010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1784747884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1784747816"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3A6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1784747815"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1784833657"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.2",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42504",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-02T23:01:00.320527+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "RHBZ#2484204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://go.dev/cl/774481",
"url": "https://go.dev/cl/774481"
},
{
"category": "external",
"summary": "https://go.dev/issue/79217",
"url": "https://go.dev/issue/79217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5038",
"url": "https://pkg.go.dev/vuln/GO-2026-5038"
}
],
"release_date": "2026-06-02T22:01:37.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T14:47:37+00:00",
"details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ocp-4-18-release-notes\n\nFor Red Hat OpenShift Logging 6.2, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.2",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:47ca97af3513344cfd4889396e3843357323d33fddb98cce46f8e5d5a0b1a5d0_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0052d8243ab61cd2cf9961c8c521feae799b2b296401b8342fd4f5b52673f0a5_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:100e08b8c944de3a46bae4dfa155109bd6fe78479995005f47bcd4beee258924_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:802cd3226296e0feeef79baecd2a4a32fef715af3efb60b5748c9a4ebf02dd08_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:9e5f624ea6566612b579400be7648bf2fab8eebcfe4dff301b8cb4da096960e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:153ab96fc7d2bab733b62abf87631c839308d31d595d616bf8edfd2cddcabe3f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:1853bf9f3483509135dbdfd8bf708ca6fac04bb5925585d8f7a0d7053823dcfb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:4fd3fcc1466cfad850d25ff825dd3e8542afb391af2d70e50a279d0829d9267c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:666a815d03869f65903b2a8d87bea5aa965912521512dcb1618b0d06dcb9174e_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:7d4101bfd718c9613264ccc2391d37893897a9ce362b443923f02824256a1a7d_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:99310027ad651fdd6b13d1cc2698f4edeb63eef6340144c66c7f90a185c0ce8d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9eeef9597877ed7ac9a1a0d0ec1daa941a503c3e7e38135b4a263f35ad8668e5_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cc636250743b619bfa997f02a22850503cdbe3df90f77a27259bc1c7184b470e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:1e316441723ad6e2ce988755709a2e2d98406fc58f06942c42b0b701e33b64b7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:65fb432f914dc0b384a4c7d97a3d520ee127cf9c3b773e7f91b28b7811223b62_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9634da775abc1c3b64b33a7fe3e891e543caf321099eb8b989f9c833471047b2_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:a80f627cee8092acfa7f248c90f162e04d9435aa6aafa38365b68a341bdc4039_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:99ad45fe6f420e59b6cc207b92e14f4e2637a1f5a4daac0776075aa365419d88_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:161adf962803dfcc53ffedfe2cdda056760d227b0e39a9f71dd93aec8392630f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6f0b3b3f82757b7c908a027466f6f58adb6ef44732af52c8d80f4c2e686b6859_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8da02916a76bc365fdd07f25ecd6e0ea9cf5f9b61a8368a2681b98eaee5de3b6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:e2574a9506247daf24517c927f3fc300be1a92941e9a637a6ac8ca7c8c8a3e53_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3f354761f4982ed497a7a6a9456515b42574e1eee062d1e28676ecb98f205c2e_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:6d706b347ad30aaa388fe171fb2b16b15a3f60a99443831ee90bf43308f61b60_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae8aaecae41cea28ac9a59468024942b9528de7b150453c99ceb1eb1ed8d921a_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b81b71052c82ae685491fbdaf45c5e5da0ac8a322ae4697ad8ea061cbd8eaf8a_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:134bafee4bb7fcf1fbd1242ca7b5a5ce99296eed19b982f2fa0fab69aa596881_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:22f133df7b02ce4cc6e8b8dc64d74d79ea7ba9a662811b244701f1e1a01aec0f_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:6ce28aaad7cb3b99c4c332e3b465088007498b2414f04fc6e4d64338aeda193a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c89b17564cd8fd241ffa9d10d51d8188c0a89ad747931536f4988bc5e987ec36_amd64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3c4bb088d49442d4a97a315ef00646a59b64a761d4b82cc7aec57cc1ed35d2a8_arm64",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:7049a300a62a6a40dd8067f250772fcb85e82d9771e553b8a04184e1e3014132_s390x",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80988b355a96553bff20c13429bc7d137867ac26909bf05c310376ca4c64598a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.2:registry.redhat.io/openshift-logging/vector-rhel9@sha256:8f2477cef6ef3cd7c302127b5b9e7394047f62e7e0016935e1d06fdd07d3e784_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
}
]
}
RHSA-2026:48771
Vulnerability from csaf_redhat - Published: 2026-07-30 13:15 - Updated: 2026-08-22 20:30Summary
Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release
Severity
Important
Notes
Topic: The 1.4.3 release of the RHTAS CLIs.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Details: The RHTAS CLI Stack images for RHTAS 1.4.3
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.
5.5 (Medium)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
References
126 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The 1.4.3 release of the RHTAS CLIs.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS CLI Stack images for RHTAS 1.4.3",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:48771",
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39833",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48771.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release",
"tracking": {
"current_release_date": "2026-08-22T20:30:34+00:00",
"generator": {
"date": "2026-08-22T20:30:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:48771",
"initial_release_date": "2026-07-30T13:15:29+00:00",
"revision_history": [
{
"date": "2026-07-30T13:15:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T20:30:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.4",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "conforma-cli-stack-v1-4@amd64_darwin",
"product_id": "conforma-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_darwin_amd64.tar.gz\u0026checksum=sha256:ba0319fcf14ce9af09aea60ac6ded7493fcc3805d657ab3cafcccce258cdbc24\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "cosign-cli-stack-v1-4@amd64_darwin",
"product_id": "cosign-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_darwin_amd64.tar.gz\u0026checksum=sha256:89fe2f185b14bb9cf8cd5fdc2997b11b6a3d6e344c29d9bfb0c6678fc4e789d2\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_darwin_amd64.tar.gz\u0026checksum=sha256:8e144593f7988904a732c9b2984b426a5a0656d054ae2bc4d990721814437c6a\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64_darwin",
"product_id": "gitsign-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_darwin_amd64.tar.gz\u0026checksum=sha256:ddbb1fe6762a246b031d1ad6684adb4fa6ebada079242d439c4d0bb564426d09\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product_id": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_darwin_amd64.tar.gz\u0026checksum=sha256:56ecfb9f0a96bf7e8912d4c7b80ff7da1bb783eb68466b38dca7206434441acb\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "rekor-cli-stack-v1-4@amd64_darwin",
"product_id": "rekor-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_darwin_amd64.tar.gz\u0026checksum=sha256:55c0c62a6c54e8737b2cc6cbd37a1a49be5807da1097124ed5d39173731d610e\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "trillian-cli-stack-v1-4@amd64_darwin",
"product_id": "trillian-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=updatetree_darwin_amd64.tar.gz\u0026checksum=sha256:8031a91d5d2fd81e62d364a3e1a65f3cab696640a334f36eaf0de04252771358\u0026download_url=https://developers.qa.redhat.com/products"
}
}
}
],
"category": "architecture",
"name": "amd64_darwin"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "conforma-cli-stack-v1-4@arm64_darwin",
"product_id": "conforma-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_darwin_arm64.tar.gz\u0026checksum=sha256:f94cb68da5dd2e397443863c8306ba903277dab26bfc8bf5ae1f3d9e7a7bccf3\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "cosign-cli-stack-v1-4@arm64_darwin",
"product_id": "cosign-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_darwin_arm64.tar.gz\u0026checksum=sha256:be6c8f783a6606938968a547dddffe8c860f404a21d61d0757a7e173d9a87860\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_darwin_arm64.tar.gz\u0026checksum=sha256:5cc43b5d7aaa3829c93f21d95b9c4a27f08043cfb2b5e5b6e50fd39566def195\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "gitsign-cli-stack-v1-4@arm64_darwin",
"product_id": "gitsign-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_darwin_arm64.tar.gz\u0026checksum=sha256:0a0667c88d39d6208f298ba84440f55e3054bc35c3dffcf86039bda233a82f89\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product_id": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_darwin_arm64.tar.gz\u0026checksum=sha256:eae6ee618548fc7febb3256c8941f1a0ec829b8476e66078efd84dadff97d51f\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "rekor-cli-stack-v1-4@arm64_darwin",
"product_id": "rekor-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_darwin_arm64.tar.gz\u0026checksum=sha256:2e5d2e6a36d03862962cc8cbe0609f8b090f1319187763c188e268e149a211a6\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "trillian-cli-stack-v1-4@arm64_darwin",
"product_id": "trillian-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=updatetree_darwin_arm64.tar.gz\u0026checksum=sha256:b90f2ec19c2e8790a31d523aa75da5d31cc223ca207c25f720e0e893ceedcb2b\u0026download_url=https://developers.qa.redhat.com/products"
}
}
}
],
"category": "architecture",
"name": "arm64_darwin"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64",
"product": {
"name": "conforma-cli-stack-v1-4@amd64",
"product_id": "conforma-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_amd64.tar.gz\u0026checksum=sha256:9d67d0f809f8576c253ac2437aa7a1eb90a65e2f28da1f5c7ee4c4fe568f2d55\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64",
"product": {
"name": "cosign-cli-stack-v1-4@amd64",
"product_id": "cosign-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_amd64.tar.gz\u0026checksum=sha256:4a65933981e9eeb85e0a1b270411b44bde2ce3d008201a894e2af6a5440fe25c\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_amd64.tar.gz\u0026checksum=sha256:dcddc1ae6817d0595ce76e65fd11a7de32706645410ff891e160a641084ad379\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64",
"product_id": "gitsign-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_amd64.tar.gz\u0026checksum=sha256:772835071524d4670c44f48e73166118f088baf567d2019532d45c492c15c6de\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64",
"product_id": "model-transparency-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_pkcs11_linux_amd64.tar.gz\u0026checksum=sha256:031c0547d645585a70a99461f35ae3a77a1e30790336915c6000e7bedd971b6f\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64",
"product": {
"name": "rekor-cli-stack-v1-4@amd64",
"product_id": "rekor-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_amd64.tar.gz\u0026checksum=sha256:7dec4aff3daf64908417ca9ff5fa3822b6c41dcc63c20b832f6eb7963374b8d8\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64",
"product": {
"name": "trillian-cli-stack-v1-4@amd64",
"product_id": "trillian-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=updatetree_linux_amd64.tar.gz\u0026checksum=sha256:42cfc2fd535bccc2bc623c61f736483313bd0f662f21501f42e902349435d15a\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "tuftool-cli-stack-v1-4@amd64",
"product": {
"name": "tuftool-cli-stack-v1-4@amd64",
"product_id": "tuftool-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/tuftool-cli-stack-v1-4@1.4.3?filename=tuftool_linux_amd64.tar.gz\u0026checksum=sha256:5b288bfedf17b2a07486f16457b8405d34cf4081f76534b678fa7cdcd413f82b\u0026download_url=https://developers.qa.redhat.com/products"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@arm64",
"product": {
"name": "conforma-cli-stack-v1-4@arm64",
"product_id": "conforma-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_arm64.tar.gz\u0026checksum=sha256:d22c843c2cb8dad6b525614cddf62d20e2536260ddb9e8215a68ba34950ecda9\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@arm64",
"product": {
"name": "cosign-cli-stack-v1-4@arm64",
"product_id": "cosign-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_arm64.tar.gz\u0026checksum=sha256:e8ff0ea9f5104e81d9b57b297d65c41b760556d70c98e8e21a612beb242ff731\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_arm64.tar.gz\u0026checksum=sha256:b2418f32be12f4e93c6bf993daa11243fa40f3aeafd46422b1f3badc7ca4b532\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@arm64",
"product": {
"name": "gitsign-cli-stack-v1-4@arm64",
"product_id": "gitsign-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_arm64.tar.gz\u0026checksum=sha256:b8f320b723bb722565a78b51783bc750c28b8cc02ef6a08698e14cdb7773f0a2\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@arm64",
"product": {
"name": "model-transparency-cli-stack-v1-4@arm64",
"product_id": "model-transparency-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_pkcs11_linux_arm64.tar.gz\u0026checksum=sha256:63182bbf957c0e156e9f695776875f7a53c9a187ceb14caae2b03b0f2ce4df43\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@arm64",
"product": {
"name": "rekor-cli-stack-v1-4@arm64",
"product_id": "rekor-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_arm64.tar.gz\u0026checksum=sha256:aa13a0ea35439464cf241988216a8dd2c9e40ad846e243ea9dae9b49b4a11ec3\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@arm64",
"product": {
"name": "trillian-cli-stack-v1-4@arm64",
"product_id": "trillian-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=updatetree_linux_arm64.tar.gz\u0026checksum=sha256:91d5b66c1d54c0efd257e4902a6692f51edb93e155643b8e6b50dc275c1bb048\u0026download_url=https://developers.qa.redhat.com/products"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@ppc64le",
"product": {
"name": "conforma-cli-stack-v1-4@ppc64le",
"product_id": "conforma-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_ppc64le.tar.gz\u0026checksum=sha256:18bd60a0143e998178e02fa7673105259e48fcbe9c32207a3bdc0d66daab8f8a\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@ppc64le",
"product": {
"name": "cosign-cli-stack-v1-4@ppc64le",
"product_id": "cosign-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_ppc64le.tar.gz\u0026checksum=sha256:179353a55fe09a3031ecb6d7ea83f692eeafa948fed8df93f5a6e08fd95f9729\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_ppc64le.tar.gz\u0026checksum=sha256:8f906cfb20e8593cfb65aba0f64900b9897eb5ca00ef76f99b08a2192af027be\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@ppc64le",
"product": {
"name": "gitsign-cli-stack-v1-4@ppc64le",
"product_id": "gitsign-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_ppc64le.tar.gz\u0026checksum=sha256:a05ff4b720561e4eae766ecd8463f56d566819505ee6d0254b01c1920dcd8af8\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@ppc64le",
"product": {
"name": "model-transparency-cli-stack-v1-4@ppc64le",
"product_id": "model-transparency-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_pkcs11_linux_ppc64le.tar.gz\u0026checksum=sha256:4fc781761f359570a87defdad0e8f9992e3b84dcdf59ff72fb0ea60df210de83\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@ppc64le",
"product": {
"name": "rekor-cli-stack-v1-4@ppc64le",
"product_id": "rekor-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_ppc64le.tar.gz\u0026checksum=sha256:b36ce275d5e6735e69c51233ebac81aac6dc3f48c03ebd03ea6e548e5c4f02d7\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@ppc64le",
"product": {
"name": "trillian-cli-stack-v1-4@ppc64le",
"product_id": "trillian-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=updatetree_linux_ppc64le.tar.gz\u0026checksum=sha256:43e2b76086c4c7b96304da59f98dbcaedb61e8f6dfa9ad40ee3c0a9dcc70b410\u0026download_url=https://developers.qa.redhat.com/products"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@s390x",
"product": {
"name": "conforma-cli-stack-v1-4@s390x",
"product_id": "conforma-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_s390x.tar.gz\u0026checksum=sha256:2fe947638045e305fc2ee1a648f55e2b0e3215fe590ab3eaa0d7ac9e79544889\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@s390x",
"product": {
"name": "cosign-cli-stack-v1-4@s390x",
"product_id": "cosign-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_s390x.tar.gz\u0026checksum=sha256:3681aea2d65788ba26a64e31acbb96051458b8075b1482b4f338b7ba12a6b289\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_s390x.tar.gz\u0026checksum=sha256:69498733a8e39078a9a5627a2dcfced108c0ecc7965fd2d16c25fc6e2feb3858\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@s390x",
"product": {
"name": "gitsign-cli-stack-v1-4@s390x",
"product_id": "gitsign-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_s390x.tar.gz\u0026checksum=sha256:3e7eb54efaeb4faa1c6b5c64d5017b5afd6290f5202695bf1220acf25a2ad026\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@s390x",
"product": {
"name": "model-transparency-cli-stack-v1-4@s390x",
"product_id": "model-transparency-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_pkcs11_linux_s390x.tar.gz\u0026checksum=sha256:a41fc6dafc44a3ef9cc45b71dcc557a4f633a3b3e13ea7672a77dd6666cfa9c8\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@s390x",
"product": {
"name": "rekor-cli-stack-v1-4@s390x",
"product_id": "rekor-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_s390x.tar.gz\u0026checksum=sha256:2afe6927478749fd550190111781d8ad529294bf0a7570d7059f14eb9ced52be\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@s390x",
"product": {
"name": "trillian-cli-stack-v1-4@s390x",
"product_id": "trillian-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=updatetree_linux_s390x.tar.gz\u0026checksum=sha256:6fed7506d560d15237996996a02e37f0724e904c1fd4911e12b0896823881b36\u0026download_url=https://developers.qa.redhat.com/products"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64_windows",
"product": {
"name": "conforma-cli-stack-v1-4@amd64_windows",
"product_id": "conforma-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_windows_amd64.zip\u0026checksum=sha256:aab8df482a3af57bed8d3d5e707bad83a4df4df78dfdd1abee09f8661cc77292\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64_windows",
"product": {
"name": "cosign-cli-stack-v1-4@amd64_windows",
"product_id": "cosign-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_windows_amd64.zip\u0026checksum=sha256:ed5e15b31fbf8730930ca0ca372efaea8e036703dc662b0a292ff632e8a538f5\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_windows_amd64.zip\u0026checksum=sha256:8397786f43ddc3e272fe73880a2947eb56fb5120ce3442f7bd6b4f0ee4fb8d28\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64_windows",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64_windows",
"product_id": "gitsign-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_windows_amd64.zip\u0026checksum=sha256:5163527dc7d890b6d05d66c353a67702d148c43c66aaec366dcf90e5307533dc\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64_windows",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64_windows",
"product_id": "model-transparency-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_windows_amd64.exe.gz\u0026checksum=sha256:90f187d79b8dfd39cca62120fdabbfc685c9f99c7c7f16f80dbf296defef72e1\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64_windows",
"product": {
"name": "rekor-cli-stack-v1-4@amd64_windows",
"product_id": "rekor-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_windows_amd64.zip\u0026checksum=sha256:8e1fe853c7a5594822fe91cdc62e37b2851e49bb70a89fa47c662dc6ae4ddc7c\u0026download_url=https://developers.qa.redhat.com/products"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64_windows",
"product": {
"name": "trillian-cli-stack-v1-4@amd64_windows",
"product_id": "trillian-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=updatetree_windows_amd64.zip\u0026checksum=sha256:8a2bd8d3f3d2e1624e6f1a4b862c3c0d8edd17663d0b3f4625a3a0b32232f8ca\u0026download_url=https://developers.qa.redhat.com/products"
}
}
}
],
"category": "architecture",
"name": "amd64_windows"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64"
},
"product_reference": "conforma-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "conforma-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows"
},
"product_reference": "conforma-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64"
},
"product_reference": "conforma-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "conforma-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le"
},
"product_reference": "conforma-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
},
"product_reference": "conforma-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64"
},
"product_reference": "cosign-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "cosign-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows"
},
"product_reference": "cosign-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64"
},
"product_reference": "cosign-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "cosign-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le"
},
"product_reference": "cosign-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x"
},
"product_reference": "cosign-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64"
},
"product_reference": "gitsign-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "gitsign-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le"
},
"product_reference": "gitsign-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x"
},
"product_reference": "gitsign-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64"
},
"product_reference": "model-transparency-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "model-transparency-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le"
},
"product_reference": "model-transparency-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x"
},
"product_reference": "model-transparency-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64"
},
"product_reference": "rekor-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "rekor-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows"
},
"product_reference": "rekor-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64"
},
"product_reference": "rekor-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "rekor-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le"
},
"product_reference": "rekor-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x"
},
"product_reference": "rekor-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64"
},
"product_reference": "trillian-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "trillian-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows"
},
"product_reference": "trillian-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64"
},
"product_reference": "trillian-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "trillian-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le"
},
"product_reference": "trillian-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x"
},
"product_reference": "trillian-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tuftool-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
},
"product_reference": "tuftool-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39833",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-05-22T04:01:35.714593+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480683"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Moderate with RH CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). A flaw was found in golang.org/x/crypto/ssh/agent where the in-memory keyring returned by NewKeyring() silently accepted SSH agent keys with the ConfirmBeforeUse constraint but did not enforce interactive confirmation before signing. Exploitation requires local access and low privileges on a system where an affected application uses NewKeyring() with ConfirmBeforeUse. Most Red Hat products that bundle golang.org/x/crypto do not use the ssh/agent ConfirmBeforeUse feature in their supported execution paths. The upstream CISA CVSS 9.1 assumes a broader network attack context that does not reflect Red Hat product deployment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "RHBZ#2480683",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480683"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://go.dev/cl/778640",
"url": "https://go.dev/cl/778640"
},
{
"category": "external",
"summary": "https://go.dev/cl/778641",
"url": "https://go.dev/cl/778641"
},
{
"category": "external",
"summary": "https://go.dev/issue/79436",
"url": "https://go.dev/issue/79436"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5005",
"url": "https://pkg.go.dev/vuln/GO-2026-5005"
}
],
"release_date": "2026-05-22T02:31:26.294000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T13:15:29+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
}
]
}
RHSA-2026:49767
Vulnerability from csaf_redhat - Published: 2026-08-03 18:13 - Updated: 2026-08-22 20:30Summary
Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release
Severity
Important
Notes
Topic: The 1.4.3 release of the RHTAS CLIs.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Details: The RHTAS CLI Stack images for RHTAS 1.4.3
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.
5.5 (Medium)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
References
126 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The 1.4.3 release of the RHTAS CLIs.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS CLI Stack images for RHTAS 1.4.3",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:49767",
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39833",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49767.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release",
"tracking": {
"current_release_date": "2026-08-22T20:30:44+00:00",
"generator": {
"date": "2026-08-22T20:30:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:49767",
"initial_release_date": "2026-08-03T18:13:05+00:00",
"revision_history": [
{
"date": "2026-08-03T18:13:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T20:30:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.4",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "conforma-cli-stack-v1-4@amd64_darwin",
"product_id": "conforma-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_darwin_amd64.tar.gz\u0026checksum=sha256%3Ae75dc3d7df27fa5532642887c6a2989a5997507da4ff6677cc09b32b7d4f0cd0\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "cosign-cli-stack-v1-4@amd64_darwin",
"product_id": "cosign-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_darwin_amd64.tar.gz\u0026checksum=sha256%3Ad6cc0d62c9f820ee8856ef2cf766cb981c0a898c1bc2e5da541298b92fe9f48d\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_darwin_amd64.tar.gz\u0026checksum=sha256%3A4dc2de8a2c12c9499f0101148b7864680b4c74bdf4fb44c02d2a7966e63b978d\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64_darwin",
"product_id": "gitsign-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_darwin_amd64.tar.gz\u0026checksum=sha256%3A6b8a2b930fbd3695d0555585c412594b30b2506d9f9acfb6b6339c742a91a6ba\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product_id": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_darwin_amd64.tar.gz\u0026checksum=sha256%3A42582688ba3a4c6d1eebba9ffbc385f2f606ec376bac977395c6c31e9d27f575\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "rekor-cli-stack-v1-4@amd64_darwin",
"product_id": "rekor-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_darwin_amd64.tar.gz\u0026checksum=sha256%3Aca3361e621846d985e2b04e77138097cd679402c88ad5ee7aa281cc33e89a7fe\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "trillian-cli-stack-v1-4@amd64_darwin",
"product_id": "trillian-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_darwin_amd64.tar.gz\u0026checksum=sha256%3Aac86c9f4eadfea26a37e04b62cd79b1fb4a51eccfaac17f2e1f8fefa1d3609e8\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "amd64_darwin"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "conforma-cli-stack-v1-4@arm64_darwin",
"product_id": "conforma-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_darwin_arm64.tar.gz\u0026checksum=sha256%3Adf7bf266fd09164656e6e0b16935f1028dcd930d02868df452f76f073a766128\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "cosign-cli-stack-v1-4@arm64_darwin",
"product_id": "cosign-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_darwin_arm64.tar.gz\u0026checksum=sha256%3Ac89bf59960c1cdc08f91266782e8261c9ec14f2e9a6a54ba2702febb6f3edcf8\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_darwin_arm64.tar.gz\u0026checksum=sha256%3Adfed759f50eaf9ca63716d1517ec14ab32fe83f908a49432bee34b2b7fa12f74\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "gitsign-cli-stack-v1-4@arm64_darwin",
"product_id": "gitsign-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_darwin_arm64.tar.gz\u0026checksum=sha256%3Ab5c0783747fb834466f4e9f0e92ebd3dff94181d2b917f030ebd0b6c28f29c46\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product_id": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_darwin_arm64.tar.gz\u0026checksum=sha256%3A2f2a611fcdb377b951461c5d9bdd588cba5d2b276f7f0def5ff10c51ff7c6211\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "rekor-cli-stack-v1-4@arm64_darwin",
"product_id": "rekor-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_darwin_arm64.tar.gz\u0026checksum=sha256%3A96e5b122199bfc8972d090d3b62b6a1d3b739b3b2e7cb5afb00ffaff07484bbd\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "trillian-cli-stack-v1-4@arm64_darwin",
"product_id": "trillian-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_darwin_arm64.tar.gz\u0026checksum=sha256%3A51c236fb7321309645f0363e712a7e208746167b52634d4591ca7afc3ebe35f4\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "arm64_darwin"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64",
"product": {
"name": "conforma-cli-stack-v1-4@amd64",
"product_id": "conforma-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_amd64.tar.gz\u0026checksum=sha256%3A849c17c815b098e234b5d2e7de8a594d74aeceef9b275b7290a6c39cc87606da\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64",
"product": {
"name": "cosign-cli-stack-v1-4@amd64",
"product_id": "cosign-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_amd64.tar.gz\u0026checksum=sha256%3A40448bcf19dd95ac19281503edad38837ee754210b0910ffa33ce01616bc483d\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_amd64.tar.gz\u0026checksum=sha256%3Afdec9fafb327bd19e37a327ff8afdf81113839105a891ae43a4115387f448d80\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64",
"product_id": "gitsign-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_amd64.tar.gz\u0026checksum=sha256%3Ab41a91d8aaafd27f321e5c6afaa2f80a1a192b65490ed83d06fd9d1a13cd2259\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64",
"product_id": "model-transparency-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_amd64.tar.gz\u0026checksum=sha256%3Ad11f6fdf2936505d92011565b3191fede6e0c42361f3374f407104b0183d9650\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64",
"product": {
"name": "rekor-cli-stack-v1-4@amd64",
"product_id": "rekor-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_amd64.tar.gz\u0026checksum=sha256%3Ae8f93b6f40448046ea096ccbe68d3770108ee5ee35fbec23bb9f6aa00bf961f0\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64",
"product": {
"name": "trillian-cli-stack-v1-4@amd64",
"product_id": "trillian-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_amd64.tar.gz\u0026checksum=sha256%3A4a1f79d40b04cb87ba8278793ab6cadf8139d4f013911501ac2b61c1342f8bf4\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "tuftool-cli-stack-v1-4@amd64",
"product": {
"name": "tuftool-cli-stack-v1-4@amd64",
"product_id": "tuftool-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/tuftool-cli-stack-v1-4@1.4.3?filename=tuftool_linux_amd64.tar.gz\u0026checksum=sha256%3Af0274ee12240fd7d6eddda2b85edfe71debf640f881f8f87864e07607226b281\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@arm64",
"product": {
"name": "conforma-cli-stack-v1-4@arm64",
"product_id": "conforma-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_arm64.tar.gz\u0026checksum=sha256%3Ad84c73bc689218700d9134a408e24dc01a28b1366920ebbd7b74837729c4be49\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@arm64",
"product": {
"name": "cosign-cli-stack-v1-4@arm64",
"product_id": "cosign-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_arm64.tar.gz\u0026checksum=sha256%3A9ec55cf4fdae8edd492ca4eb70540edf6cff7a9d66abd537e4b16e197d35c2c4\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_arm64.tar.gz\u0026checksum=sha256%3A4e8e133040df495b1dfb5c777c7e00e839829594c4e3b5238103d6cede6732bf\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@arm64",
"product": {
"name": "gitsign-cli-stack-v1-4@arm64",
"product_id": "gitsign-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_arm64.tar.gz\u0026checksum=sha256%3Aad344e63797afc8efb929973badbdd975c84bacb07043882e87966fafc5dde31\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@arm64",
"product": {
"name": "model-transparency-cli-stack-v1-4@arm64",
"product_id": "model-transparency-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_arm64.tar.gz\u0026checksum=sha256%3Af41c6465b0729d50b466881c215e7c033ca8d325001b1a572c8259542e21a751\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@arm64",
"product": {
"name": "rekor-cli-stack-v1-4@arm64",
"product_id": "rekor-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_arm64.tar.gz\u0026checksum=sha256%3A3a0f8b948f7307efd546408f0b2ca5de177d53ddbe124edc78ffd3f8d81571ed\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@arm64",
"product": {
"name": "trillian-cli-stack-v1-4@arm64",
"product_id": "trillian-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_arm64.tar.gz\u0026checksum=sha256%3Ad0ef9416f3dab3fc977311aa9ee56c6eda926b09a5e26310dc0fd633c0fbcc62\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@ppc64le",
"product": {
"name": "conforma-cli-stack-v1-4@ppc64le",
"product_id": "conforma-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_ppc64le.tar.gz\u0026checksum=sha256%3A1a38cf42d9815165e7ba168a2ccd08d4183f30690d60779ff0365d348c9b6c73\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@ppc64le",
"product": {
"name": "cosign-cli-stack-v1-4@ppc64le",
"product_id": "cosign-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_ppc64le.tar.gz\u0026checksum=sha256%3Aeb9a30596e16a751e664789d3cf9cec89bbbaade890df56c46e6f18562cece21\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_ppc64le.tar.gz\u0026checksum=sha256%3A130934550be2ea638bcf42f0f7b987b373b31b6a1a43a73b506c7a13a76d2d48\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@ppc64le",
"product": {
"name": "gitsign-cli-stack-v1-4@ppc64le",
"product_id": "gitsign-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_ppc64le.tar.gz\u0026checksum=sha256%3A98f8bcf03a7241fb6e97fc71c10d36600066791a07423876ede59c950eb61f1b\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@ppc64le",
"product": {
"name": "model-transparency-cli-stack-v1-4@ppc64le",
"product_id": "model-transparency-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_ppc64le.tar.gz\u0026checksum=sha256%3A41c21c8e9f7bb881853fb9ce09136526010d0d4abf2f76549c76ca6f40740fba\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@ppc64le",
"product": {
"name": "rekor-cli-stack-v1-4@ppc64le",
"product_id": "rekor-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_ppc64le.tar.gz\u0026checksum=sha256%3Aad7261c944910196f7aab08e1a24dc77996d107a339d74da1d4196fd96a421e6\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@ppc64le",
"product": {
"name": "trillian-cli-stack-v1-4@ppc64le",
"product_id": "trillian-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_ppc64le.tar.gz\u0026checksum=sha256%3A96991d095eb2dd8472471d377522f9e6ef36153292bd381b022b554de4539b19\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@s390x",
"product": {
"name": "conforma-cli-stack-v1-4@s390x",
"product_id": "conforma-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_s390x.tar.gz\u0026checksum=sha256%3Aaea309944ca64070e736e4695e9624ee4405cd5dd6c5b5c3dd85e15ff8c03554\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@s390x",
"product": {
"name": "cosign-cli-stack-v1-4@s390x",
"product_id": "cosign-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_s390x.tar.gz\u0026checksum=sha256%3Ace65e11339269a1e1749aadef3add5b9d3b7487f3db8f358b4c0d2aba98e2d7a\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_s390x.tar.gz\u0026checksum=sha256%3A9fe9680fe67969fedfceb3993930056de422ff1836886145db8512ea18110368\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@s390x",
"product": {
"name": "gitsign-cli-stack-v1-4@s390x",
"product_id": "gitsign-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_s390x.tar.gz\u0026checksum=sha256%3Aec9f094da7b0307fdc2d8440ca421caaaff22ab337c796fadeb7009313b6c564\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@s390x",
"product": {
"name": "model-transparency-cli-stack-v1-4@s390x",
"product_id": "model-transparency-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_s390x.tar.gz\u0026checksum=sha256%3A2655b8c2c57d107325710857fb7ca22c439b5466abd8adf60792b9821da9efc4\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@s390x",
"product": {
"name": "rekor-cli-stack-v1-4@s390x",
"product_id": "rekor-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_s390x.tar.gz\u0026checksum=sha256%3A0d8eadf8b8aee4e8e4eee350ef54c21ca921f9d3678157c8710d3ea3fb5d2215\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@s390x",
"product": {
"name": "trillian-cli-stack-v1-4@s390x",
"product_id": "trillian-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_s390x.tar.gz\u0026checksum=sha256%3A029eadc83ace4ec12004539731d3b11817a0939c929bfa1895dad45bf4233899\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64_windows",
"product": {
"name": "conforma-cli-stack-v1-4@amd64_windows",
"product_id": "conforma-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_windows_amd64.zip\u0026checksum=sha256%3Ab1e762e1277bf10d0ea1cd06268d521f827b41adff7898d3f2e90ef1f92b9459\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64_windows",
"product": {
"name": "cosign-cli-stack-v1-4@amd64_windows",
"product_id": "cosign-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_windows_amd64.zip\u0026checksum=sha256%3A38f4682466f7f1f9b6f0d0fa8b3faa635c94a604a0cb503280a139ee472fe0e6\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_windows_amd64.zip\u0026checksum=sha256%3A71479daf6769fff4772c5e17684f7f86b91b7eeaffba0144df6f8fe78b4d0306\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64_windows",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64_windows",
"product_id": "gitsign-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_windows_amd64.zip\u0026checksum=sha256%3A6fef4f4b207582acdc89736dba2155dabed565b8946be14211a4b64e744cb72b\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64_windows",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64_windows",
"product_id": "model-transparency-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_windows_amd64.exe.gz\u0026checksum=sha256%3A54414f4e41a7b7324464df9ba51a5c5c7a36bdf2a10243e18a18c0a07a4c7250\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64_windows",
"product": {
"name": "rekor-cli-stack-v1-4@amd64_windows",
"product_id": "rekor-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_windows_amd64.zip\u0026checksum=sha256%3A99b32d68816507be2304422886bd7991c0f0796ff5e80f3cb2e5df573dfd3fdd\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64_windows",
"product": {
"name": "trillian-cli-stack-v1-4@amd64_windows",
"product_id": "trillian-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_windows_amd64.zip\u0026checksum=sha256%3A1426e9dba9f83dc9f9e7e74a8930d223cbc9179860aeb5dcc988f5f1b06eec70\u0026download_url=https%3A%2F%2Fdevelopers.qa.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "amd64_windows"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64"
},
"product_reference": "conforma-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "conforma-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows"
},
"product_reference": "conforma-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64"
},
"product_reference": "conforma-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "conforma-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le"
},
"product_reference": "conforma-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
},
"product_reference": "conforma-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64"
},
"product_reference": "cosign-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "cosign-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows"
},
"product_reference": "cosign-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64"
},
"product_reference": "cosign-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "cosign-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le"
},
"product_reference": "cosign-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x"
},
"product_reference": "cosign-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64"
},
"product_reference": "gitsign-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "gitsign-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le"
},
"product_reference": "gitsign-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x"
},
"product_reference": "gitsign-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64"
},
"product_reference": "model-transparency-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "model-transparency-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le"
},
"product_reference": "model-transparency-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x"
},
"product_reference": "model-transparency-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64"
},
"product_reference": "rekor-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "rekor-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows"
},
"product_reference": "rekor-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64"
},
"product_reference": "rekor-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "rekor-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le"
},
"product_reference": "rekor-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x"
},
"product_reference": "rekor-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64"
},
"product_reference": "trillian-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "trillian-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows"
},
"product_reference": "trillian-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64"
},
"product_reference": "trillian-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "trillian-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le"
},
"product_reference": "trillian-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x"
},
"product_reference": "trillian-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tuftool-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
},
"product_reference": "tuftool-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39833",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-05-22T04:01:35.714593+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480683"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Moderate with RH CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). A flaw was found in golang.org/x/crypto/ssh/agent where the in-memory keyring returned by NewKeyring() silently accepted SSH agent keys with the ConfirmBeforeUse constraint but did not enforce interactive confirmation before signing. Exploitation requires local access and low privileges on a system where an affected application uses NewKeyring() with ConfirmBeforeUse. Most Red Hat products that bundle golang.org/x/crypto do not use the ssh/agent ConfirmBeforeUse feature in their supported execution paths. The upstream CISA CVSS 9.1 assumes a broader network attack context that does not reflect Red Hat product deployment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "RHBZ#2480683",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480683"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://go.dev/cl/778640",
"url": "https://go.dev/cl/778640"
},
{
"category": "external",
"summary": "https://go.dev/cl/778641",
"url": "https://go.dev/cl/778641"
},
{
"category": "external",
"summary": "https://go.dev/issue/79436",
"url": "https://go.dev/issue/79436"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5005",
"url": "https://pkg.go.dev/vuln/GO-2026-5005"
}
],
"release_date": "2026-05-22T02:31:26.294000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T18:13:05+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
}
]
}
RHSA-2026:50300
Vulnerability from csaf_redhat - Published: 2026-08-04 17:05 - Updated: 2026-08-22 20:30Summary
Red Hat Security Advisory: Migration Toolkit for Applications
Severity
Important
Notes
Topic: A new version of Migration Toolkit for Applications (MTA) is now available.
Details: Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift.
This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage
applications for faster migration to OpenShift via the user interface.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Threats
Impact
Moderate
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Threats
Impact
Important
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.
7.4 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object prototype, Axios can unknowingly use these manipulated values in its outbound network requests. This could lead to the disclosure of sensitive information or the alteration of network communications, compromising data confidentiality and integrity.
7.4 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the __manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denial of service (DoS), resulting in response time degradation and service unavailability for end users.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.
8.6 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.
8.7 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.
7.0 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in http-proxy-middleware. A remote attacker could exploit a vulnerability in the fixRequestBody() function, which is used to re-emit a request body. By injecting carriage return and line feed characters (\r\n) into a request body key or value, an attacker can bypass security policies and validation performed by the proxy. This desynchronization between the proxy and the backend server can lead to a compromise of data integrity.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
189 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of Migration Toolkit for Applications (MTA) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. \nThis solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage\napplications for faster migration to OpenShift via the user interface.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50300",
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12143",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
"url": "https://access.redhat.com/security/cve/CVE-2026-13149"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-26996",
"url": "https://access.redhat.com/security/cve/CVE-2026-26996"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27904",
"url": "https://access.redhat.com/security/cve/CVE-2026-27904"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40895",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42041",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42044",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42264",
"url": "https://access.redhat.com/security/cve/CVE-2026-42264"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42342",
"url": "https://access.redhat.com/security/cve/CVE-2026-42342"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44486",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44487",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44488",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44492",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44494",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44495",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44496",
"url": "https://access.redhat.com/security/cve/CVE-2026-44496"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4926",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55603",
"url": "https://access.redhat.com/security/cve/CVE-2026-55603"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://developers.redhat.com/products/mta/overview",
"url": "https://developers.redhat.com/products/mta/overview"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/",
"url": "https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50300.json"
}
],
"title": "Red Hat Security Advisory: Migration Toolkit for Applications",
"tracking": {
"current_release_date": "2026-08-22T20:30:43+00:00",
"generator": {
"date": "2026-08-22T20:30:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:50300",
"initial_release_date": "2026-08-04T17:05:10+00:00",
"revision_history": [
{
"date": "2026-08-04T17:05:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T20:30:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Migration Toolkit for Applications 8.1",
"product": {
"name": "Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:migration_toolkit_applications:8.1::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Migration Toolkit for Applications"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"product_id": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-analyzer-addon-rhel9@sha256%3Ae8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-analyzer-addon-rhel9\u0026tag=1784900791"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"product_id": "registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-cli-rhel9@sha256%3A5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-cli-rhel9\u0026tag=1785171639"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"product_id": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-discovery-addon-rhel9@sha256%3A8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-discovery-addon-rhel9\u0026tag=1785168960"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"product_id": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-dotnet-external-provider-rhel9@sha256%3A64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-dotnet-external-provider-rhel9\u0026tag=1784312241"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"product_id": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-generic-external-provider-rhel9@sha256%3Af698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-generic-external-provider-rhel9\u0026tag=1784810810"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"product_id": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-hub-rhel9@sha256%3A2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-hub-rhel9\u0026tag=1784313347"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"product_id": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-java-external-provider-rhel9@sha256%3A7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-java-external-provider-rhel9\u0026tag=1785170480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"product_id": "registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-rhel9-operator@sha256%3A439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-rhel9-operator\u0026tag=1785168960"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"product_id": "registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-operator-bundle@sha256%3Abbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-operator-bundle\u0026tag=1785177948"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"product_id": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-platform-addon-rhel9@sha256%3A55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-platform-addon-rhel9\u0026tag=1784312255"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"product_id": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-solution-server-rhel9@sha256%3A52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-solution-server-rhel9\u0026tag=1785168916"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"product_id": "registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-ui-rhel9@sha256%3A32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-ui-rhel9\u0026tag=1785169013"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"product_id": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-analyzer-addon-rhel9@sha256%3Af2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-analyzer-addon-rhel9\u0026tag=1784900791"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"product_id": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-cli-rhel9@sha256%3Ad54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-cli-rhel9\u0026tag=1785171639"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"product_id": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-discovery-addon-rhel9@sha256%3Add974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-discovery-addon-rhel9\u0026tag=1785168960"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"product_id": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-dotnet-external-provider-rhel9@sha256%3A8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-dotnet-external-provider-rhel9\u0026tag=1784312241"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"product_id": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-generic-external-provider-rhel9@sha256%3Adbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-generic-external-provider-rhel9\u0026tag=1784810810"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"product_id": "registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-hub-rhel9@sha256%3A34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-hub-rhel9\u0026tag=1784313347"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"product_id": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-java-external-provider-rhel9@sha256%3A3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-java-external-provider-rhel9\u0026tag=1785170480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"product_id": "registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-rhel9-operator@sha256%3Ac5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-rhel9-operator\u0026tag=1785168960"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"product_id": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-platform-addon-rhel9@sha256%3A609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-platform-addon-rhel9\u0026tag=1784312255"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"product_id": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-solution-server-rhel9@sha256%3A8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-solution-server-rhel9\u0026tag=1785168916"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64",
"product_id": "registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-ui-rhel9@sha256%3A8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-ui-rhel9\u0026tag=1785169013"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64 as a component of Red Hat Migration Toolkit for Applications 8.1",
"product_id": "Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4926",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-03-26T20:03:28.427630+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in `path-to-regexp` that can lead to a Denial of Service. The vulnerability occurs when specially crafted input containing multiple sequential optional groups is used to generate regular expressions, causing exponential resource consumption.\n\nThe Red Hat Advanced Cluster Security is not affected by this issue since it\u0027s shipping a `path-to-regexp` version which doesn\u0027t contain the vulnerable code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "RHBZ#2451867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"release_date": "2026-03-26T18:59:38+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions"
},
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-12T19:00:57.360953+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "form-data: form-data: Form field override via CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "RHBZ#2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/93.html",
"url": "https://cwe.mitre.org/data/definitions/93.html"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435",
"url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229",
"url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045",
"url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx",
"url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"
},
{
"category": "external",
"summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data",
"url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/form-data",
"url": "https://www.npmjs.com/package/form-data"
}
],
"release_date": "2026-06-12T18:01:30.362000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "form-data: form-data: Form field override via CRLF injection"
},
{
"cve": "CVE-2026-13149",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-06-30T10:00:59.843854+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494813"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13149"
},
{
"category": "external",
"summary": "RHBZ#2494813",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/brace-expansion",
"url": "https://www.npmjs.com/package/brace-expansion"
}
],
"release_date": "2026-06-30T08:30:34.502000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
},
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-26996",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-20T04:01:11.896063+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2441268"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26996"
},
{
"category": "external",
"summary": "RHBZ#2441268",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26996"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
"url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"
}
],
"release_date": "2026-02-20T03:05:21.105000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-27904",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-02-26T02:01:23.004531+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442922"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires that a user or service processes untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27904"
},
{
"category": "external",
"summary": "RHBZ#2442922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442922"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27904"
},
{
"category": "external",
"summary": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74",
"url": "https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"
}
],
"release_date": "2026-02-26T01:07:42.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-40895",
"cwe": {
"id": "CWE-212",
"name": "Improper Removal of Sensitive Information Before Storage or Transfer"
},
"discovery_date": "2026-04-21T21:02:33.280553+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460297"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "RHBZ#2460297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460297"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"
}
],
"release_date": "2026-04-21T19:59:59.759000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-42041",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:41.034289+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461629"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "RHBZ#2461629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461629"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
"url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
}
],
"release_date": "2026-04-24T17:55:30.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling"
},
{
"cve": "CVE-2026-42044",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:13.418725+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461624"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution \"Gadget\" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "RHBZ#2461624",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"
}
],
"release_date": "2026-04-24T17:49:49.517000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget"
},
{
"cve": "CVE-2026-42264",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-05-08T04:02:21.039378+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467927"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system\u0027s object prototype, Axios can unknowingly use these manipulated values in its outbound network requests. This could lead to the disclosure of sensitive information or the alteration of network communications, compromising data confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important prototype pollution flaw in Axios could result in information disclosure and network request manipulation. The vulnerability occurs when a co-located dependency in the application environment successfully pollutes the JavaScript `Object.prototype`. Under these conditions, Axios may unknowingly incorporate the manipulated properties into its outbound HTTP requests, potentially compromising data confidentiality and integrity. Exploitation is contingent on a prior successful prototype pollution attack from another component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42264"
},
{
"category": "external",
"summary": "RHBZ#2467927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42264"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42264",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42264"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa",
"url": "https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10779",
"url": "https://github.com/axios/axios/pull/10779"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.2",
"url": "https://github.com/axios/axios/releases/tag/v1.15.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj",
"url": "https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj"
}
],
"release_date": "2026-05-08T03:20:24.248000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Prototype pollution allows information disclosure and request manipulation"
},
{
"cve": "CVE-2026-42342",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-02T20:02:09.305521+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484116"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the __manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denial of service (DoS), resulting in response time degradation and service unavailability for end users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in React Router (Framework Mode) and Remix (@remix-run/server-runtime). Crafted requests to the __manifest endpoint can trigger unbounded path expansion, consuming disproportionate server resources and causing denial of service through response time degradation or complete service unavailability. This only affects applications using React Router Framework Mode or Remix server runtime; applications using Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider) are not impacted. In Red Hat products, affected React Router components are used in internal console UIs that are deployed behind authenticated ingress, reducing the attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42342"
},
{
"category": "external",
"summary": "RHBZ#2484116",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484116"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42342"
},
{
"category": "external",
"summary": "https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78",
"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78"
}
],
"release_date": "2026-06-02T18:23:02.765000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\nUpgrade to a patched version to fully mitigate the issues (ref: https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78).",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42504",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-02T23:01:00.320527+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "RHBZ#2484204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://go.dev/cl/774481",
"url": "https://go.dev/cl/774481"
},
{
"category": "external",
"summary": "https://go.dev/issue/79217",
"url": "https://go.dev/issue/79217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5038",
"url": "https://pkg.go.dev/vuln/GO-2026-5038"
}
],
"release_date": "2026-06-02T22:01:37.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
},
{
"cve": "CVE-2026-44486",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:30.944384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487947"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "RHBZ#2487947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc",
"url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"
}
],
"release_date": "2026-06-11T15:39:07.714000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects"
},
{
"cve": "CVE-2026-44487",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:34.091476+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487948"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Axios affecting Node.js environments. When an application uses Axios with an authenticated HTTP proxy and follows redirects from an HTTP to a non-proxied HTTPS destination, the Proxy-Authorization header may be inadvertently sent to the final origin server. This could lead to the exposure of sensitive proxy credentials to an unintended third party.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "RHBZ#2487948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v",
"url": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v"
}
],
"release_date": "2026-06-11T15:38:25.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via redirect flows"
},
{
"cve": "CVE-2026-44488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T17:01:36.836488+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Denial of Service due to unenforced request and response size limits",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A denial of service flaw was found in Axios, a JavaScript HTTP client library. This issue arises when applications utilize the `fetch` adapter, as configured request and response size limits are not properly enforced. A remote attacker could exploit this by sending or receiving excessively large data bodies, leading to resource exhaustion and potential denial of service in affected server-side applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "RHBZ#2487949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"
}
],
"release_date": "2026-06-11T15:37:38.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Denial of Service due to unenforced request and response size limits"
},
{
"cve": "CVE-2026-44492",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-06-11T17:00:56.761751+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487938"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Axios, a JavaScript HTTP client library, that allows for a proxy bypass. When a `NO_PROXY` environment variable is configured to prevent direct connections to specific IPv4 addresses, an attacker can craft a request URL using the IPv4-mapped IPv6 address format. This bypasses the intended `NO_PROXY` exclusion, routing the request through the configured proxy and potentially exposing internal services or sensitive information, such as cloud instance metadata credentials.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "RHBZ#2487938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"release_date": "2026-06-11T15:29:13.890000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization"
},
{
"cve": "CVE-2026-44494",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:01:12.945664+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "RHBZ#2487942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh",
"url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh"
}
],
"release_date": "2026-06-11T15:32:03.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution"
},
{
"cve": "CVE-2026-44495",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:00:53.999811+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Axios, a promise-based HTTP client, can lead to information disclosure, including credential theft and response hijacking, or denial of service. Exploitation requires a separate prototype pollution vulnerability in the same JavaScript process, allowing an attacker to control `Object.prototype.transformResponse`. Red Hat products using affected Axios versions are at risk if another component introduces such pollution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "RHBZ#2487937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw"
}
],
"release_date": "2026-06-11T15:33:12.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure due to prototype pollution vulnerability"
},
{
"cve": "CVE-2026-44496",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-06-11T17:01:15.856386+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487943"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Axios can lead to a client-side Denial of Service. An attacker capable of influencing the XSRF cookie name within a browser environment could trigger excessive regular expression processing, causing the affected browser tab to freeze and degrade user availability. This issue specifically impacts browser-based applications and does not affect Node.js HTTP adapter usage, React Native, or web workers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44496"
},
{
"category": "external",
"summary": "RHBZ#2487943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf"
}
],
"release_date": "2026-06-11T15:34:28.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name"
},
{
"cve": "CVE-2026-55603",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-22T21:01:20.731034+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491525"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in http-proxy-middleware. A remote attacker could exploit a vulnerability in the fixRequestBody() function, which is used to re-emit a request body. By injecting carriage return and line feed characters (\\r\\n) into a request body key or value, an attacker can bypass security policies and validation performed by the proxy. This desynchronization between the proxy and the backend server can lead to a compromise of data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "http-proxy-middleware: http-proxy-middleware: Data integrity compromise via CR/LF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as having Moderate impact for Red Hat products that bundle http-proxy-middleware 3.0.5 in a proxy configuration that re-emits an already-consumed request body via fixRequestBody(). Affected components are tracked via delegated engineering trackers and include Cluster Observability Operator\u0027s Prometheus console proxy, the Konflux mintmaker-renovate-image, Migration Toolkit for Applications (MTA) UI, RHTAS console UI, and RHTPA/Trustification service. Red Hat OpenShift AI MLflow images were initially assessed as in-scope but ship http-proxy-middleware 1.3.1/2.0.6, both outside the vulnerable ranges (\u003e= 3.0.4, \u003c 3.0.7 and \u003e= 4.0.0, \u003c 4.1.1), and are not affected. Other Red Hat products either do not bundle an affected http-proxy-middleware version or do not expose the vulnerable code path in normal operation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55603"
},
{
"category": "external",
"summary": "RHBZ#2491525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491525"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55603"
},
{
"category": "external",
"summary": "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm",
"url": "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm"
}
],
"release_date": "2026-06-22T20:07:05.034000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T17:05:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50300"
},
{
"category": "workaround",
"details": "Restrict network access to affected proxy services. Do not pass untrusted user input into proxy target or header configuration. Upgrade http-proxy-middleware to 3.0.7 or 4.1.1 (or later) once updated packages are available for the affected components.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:e8a9614c7189c8ae2951ef3bd4b3a5dc548917333d5ccadf81bf9cf1bd182e85_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:f2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:5cf496005c3b5ff4c73f5adcb61f907362d82f47962b9c9a9c537b55b5ee0190_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-cli-rhel9@sha256:d54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:8d2acae43f6b37761ba89fa6471c5e7dbcaae48f27d88e32f07c78dd929a7d6d_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:dd974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:64fa6c4a8a927f755be0eaa973abd7753c1c28c0086bf94f95a983b23b6c35ce_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:dbea5a31d965cf3300144f3323ea30c9db33a05ab98cb343d5cdd9edb66f29f6_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-generic-external-provider-rhel9@sha256:f698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:2115efc013299f9e2b9fec1adf1e44ca715cc260565b42537c4438d81c6a60bb_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-hub-rhel9@sha256:34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:3c65b7377bc1a3430b6349dba1aecdd99787f20ad2c433a4d93585adc1c6674d_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-operator-bundle@sha256:bbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:55ac64ef75bc633eadccf4da25f33ddef134c557b706746408b4da0cfb768042_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:439729fd40aab21c427a919a6852cc90e8eb2c0206f21657946d7e48d396e09f_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-rhel9-operator@sha256:c5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:52cfae6d1aedcc12935b696e00cd4c83c415d7dca6ad0c6289e92692a594aab0_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec_arm64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:32b552436a7fe57fafdeb1c2383b3a98a91123e7c1f38511b8c47eb76a8b2b29_amd64",
"Red Hat Migration Toolkit for Applications 8.1:registry.redhat.io/mta/mta-ui-rhel9@sha256:8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "http-proxy-middleware: http-proxy-middleware: Data integrity compromise via CR/LF injection"
}
]
}
RHSA-2026:50843
Vulnerability from csaf_redhat - Published: 2026-08-05 15:41 - Updated: 2026-08-22 22:14Summary
Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.16
Severity
Important
Notes
Topic: Logging for Red Hat OpenShift - 6.0.16
Details: Red Hat OpenShift Logging 6.0.16 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Vendor Fix
fix
|
Known not affected
22 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
22 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x | — |
Workaround
|
Threats
Impact
Important
References
86 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Logging for Red Hat OpenShift - 6.0.16",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Logging 6.0.16 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50843",
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50843.json"
}
],
"title": "Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.16",
"tracking": {
"current_release_date": "2026-08-22T22:14:46+00:00",
"generator": {
"date": "2026-08-22T22:14:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:50843",
"initial_release_date": "2026-08-05T15:41:43+00:00",
"revision_history": [
{
"date": "2026-08-05T15:41:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-22T06:15:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T22:14:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Logging Subsystem for Red Hat OpenShift 6.0",
"product": {
"name": "Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:logging:6.0::el9"
}
}
}
],
"category": "product_family",
"name": "Logging Subsystem for Red Hat OpenShift"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1785418871"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-operator-bundle@sha256%3Ac3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=1785422066"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3Abef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1785418851"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1785418839"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1785419067"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1785418915"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-operator-bundle@sha256%3A53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-operator-bundle\u0026tag=1785422064"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Ad2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1785418855"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3A74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1785418852"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1785419250"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1785418871"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1785418851"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Ab5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1785418839"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1785419067"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1785418915"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Aa2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1785418855"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Aa55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1785418852"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1785419250"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1785418871"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1785418851"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Ab4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1785418839"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1785419067"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Ad45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1785418915"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1785418855"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Aa553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1785418852"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Aff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1785419250"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1785418871"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1785418851"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1785418839"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1785419067"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Ad59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1785418915"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1785418855"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Ae00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1785418852"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1785419250"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.0",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42504",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-02T23:01:00.320527+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "RHBZ#2484204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://go.dev/cl/774481",
"url": "https://go.dev/cl/774481"
},
{
"category": "external",
"summary": "https://go.dev/issue/79217",
"url": "https://go.dev/issue/79217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5038",
"url": "https://pkg.go.dev/vuln/GO-2026-5038"
}
],
"release_date": "2026-06-02T22:01:37.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:41:43+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:c3dbf8252b7abd2ddb5ce367bef6de204d6eadd3590d56f1931453ff727aa1ff_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0a3cbe776357421fe89b45e9f5da54259fb91825925660e9efd2e2058b82672e_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:4a4be2066a79e4d4779d174e8843f43de6d8e643d8136b7e7d78d12c27788fbe_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:6bf40033c56ff4b18d70a84b86097d5edf3c640567a332768e229a52c16ab25a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:92047276401431f998d391f0366d33d90a4029a6c73ed89f7f1d916f99ac26e0_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:369ddc0d5aa123640e8a719e8e585af2cc8b1056f36a7d7f6c9362a774a26081_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:3b3c5451e18fe1ed223ca20bec6a2af114ef47f82891de3758c11b24abc00bee_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:6202d1c557103a08a7ab222049ce45da93c6178c0fdbd778aa4b409877f5c7e5_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:bef988925bd6f52d407fa498baabafadab6dcfbbb4986fc80ffaf7c05cda264b_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6c13d56ccaea21e2b92777800c74835899ed22b1ae9090a98a9b449ee8b582ed_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8ec20dee97b97f503e3893bea2e0f791cde84713c1d4a137ee0b44eab1e7c17b_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b4dbce1521cbbf4fc466820a51422e8b05aba5b35d700bacfa2766f53ff30ba8_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:b5103b88ec32ec7be0b17de57add891f64a7629e7475e4e77db6079b30c9b877_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:02d7bfd18770557675eba97e03a460a57513a258fbac418fe8fc8ca11efd395d_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:3cc618c7311d7770113f7fdc461bfcf95ffe5bc9c4fca4e972cc954cb9d23fb9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:4e6a7d903b99e3642158eb12058b5bff69bacaccb18e809bfe3d623d997bef7e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:5c9f1b213c785c7dcba7a4553c7cfac258d16df281c023b7d8fa357592ee0117_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:53b8c48918c6801dc54b5503c88514263e904b493799a5721d5a9a4bb0236fd9_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:1a930ff4b2a73ac06a7fd42f83eabd937cf11357e7ff9d6d2ae7a6dfe8561f71_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:81ff53215a86347b5b0455ff7348d9cdebd832ab18b862038a04f7788abbbfc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d45818a542571917247e98749c920f6bd7e349f5169d913b6fe5c21dcb15a82e_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:d59351cdcac44e2709d56ba5e8ef64dd58343594599e8680bf3f9a569f9f5de7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1b1badc0f7eed34ec9470f363de2d937d474c320faa7716fa92ec354a91cb062_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:220506ea930bc8f1b609c9ef58d754dcc81a99ee056e6ae60ee1e3b92e63e15c_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:a2fa2922cd00d4117b3f7fac7850685ab8dc2c37bac71f127928c96b64379b41_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:d2fbdc365db49efb8f12d3232c21c54ea54986c9f2c96f2f7ce7f821f5f71889_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:74bed7bb202e555583267183d21cb3bd7c6a3f5f2ae6c99732ccd48bac691cdc_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a55144687551d73c998535a2ea5676c42bcf5325a0ebaeb4f6be0074b2875c4f_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:a553bd05359427feb841f8e5376de97303b378644616a0dba6cbd8290f23d678_s390x",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:e00156dabcb83f59837d8f72738b697e9846d1bfacdf0ab143f80233c503a5b8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:01d8fd9bcac9666d491314f18cb63378f9db84ab9d96a265494a7f25a0216d9c_arm64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:11da8ed81a4bbfdfe17cd1c96a3d9e9583c5cecad712a76f3d85419a7c6383fb_amd64",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:85e122086c252c0f10966eb60768a70210754ccde6eec983430d7133cdcdfad8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.0:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ff82fa595072d9fdd8fc67e0e38906baad92eb6faced4a9ffdf872f2e59be4d9_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
}
]
}
RHSA-2026:50888
Vulnerability from csaf_redhat - Published: 2026-08-05 18:08 - Updated: 2026-08-22 20:30Summary
Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release
Severity
Important
Notes
Topic: The 1.4.3 release of the RHTAS CLIs.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Details: The RHTAS CLI Stack images for RHTAS 1.4.3
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.
5.5 (Medium)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x | — |
Vendor Fix
fix
|
Known not affected
43 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64 | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x | — | ||
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64 | — |
Threats
Impact
Important
References
126 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The 1.4.3 release of the RHTAS CLIs.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS CLI Stack images for RHTAS 1.4.3",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50888",
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39833",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50888.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release",
"tracking": {
"current_release_date": "2026-08-22T20:30:46+00:00",
"generator": {
"date": "2026-08-22T20:30:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:50888",
"initial_release_date": "2026-08-05T18:08:33+00:00",
"revision_history": [
{
"date": "2026-08-05T18:08:33+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T20:30:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.4",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "conforma-cli-stack-v1-4@amd64_darwin",
"product_id": "conforma-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_darwin_amd64.tar.gz\u0026checksum=sha256%3Abd510871ddd70ad4c77eec429f8ca4161fa6f8016bf9b21109457657d95dd206\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "cosign-cli-stack-v1-4@amd64_darwin",
"product_id": "cosign-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_darwin_amd64.tar.gz\u0026checksum=sha256%3A8ada7c9cb3128cca17ed34bf2c1cb2937b4a23597b655566e435ec38cd384353\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_darwin_amd64.tar.gz\u0026checksum=sha256%3A38a6fefa4556a7ba4847569f1ca8387150ba7118bd03bee3c9829abf8d665ea5\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64_darwin",
"product_id": "gitsign-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_darwin_amd64.tar.gz\u0026checksum=sha256%3A8f0e7e990c9c5992ae02bbf0205ca679a65edf4a7f349443fce511c110a09171\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product_id": "model-transparency-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_darwin_amd64.tar.gz\u0026checksum=sha256%3A83fb045b349eb3f2c1c36949d6fa40c12d1a0e5d71b15284c77141725eec0497\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "rekor-cli-stack-v1-4@amd64_darwin",
"product_id": "rekor-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_darwin_amd64.tar.gz\u0026checksum=sha256%3Af16aeafac638580028087659b7f9ce4f61bcd53fb16138b1bab9ff5b08843748\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64_darwin",
"product": {
"name": "trillian-cli-stack-v1-4@amd64_darwin",
"product_id": "trillian-cli-stack-v1-4@amd64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_darwin_amd64.tar.gz\u0026checksum=sha256%3A2bd80e13a7c451009b57e9a5b3cdfbd9ae7f84a5b56957e19b57e2a22c1091ae\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "amd64_darwin"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "conforma-cli-stack-v1-4@arm64_darwin",
"product_id": "conforma-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_darwin_arm64.tar.gz\u0026checksum=sha256%3Aa0d471228842a02917d01cedf6fc2a64c9198d08e17d22e149ea4188ca4da3ea\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "cosign-cli-stack-v1-4@arm64_darwin",
"product_id": "cosign-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_darwin_arm64.tar.gz\u0026checksum=sha256%3A2b3901b9cb7f02ad5a3d449a6de2d70a2ed9e3069d01ac819becd0590a8bdcdd\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_darwin_arm64.tar.gz\u0026checksum=sha256%3A158a23a2839854bb8e26133a8916acad1bb305d8defb9b3d540b8b89004fa240\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "gitsign-cli-stack-v1-4@arm64_darwin",
"product_id": "gitsign-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_darwin_arm64.tar.gz\u0026checksum=sha256%3Adbdb81bb2ba208c3b15025289d4f1813b1e09c9b229f71e82201ec2caf86f751\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product_id": "model-transparency-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_darwin_arm64.tar.gz\u0026checksum=sha256%3A5d1379f5f38ea788dfb05ac5c5ee1a979bf5be8bbfa1357962a2be2b182bd784\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "rekor-cli-stack-v1-4@arm64_darwin",
"product_id": "rekor-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_darwin_arm64.tar.gz\u0026checksum=sha256%3A8d2a32ff42f82f7839cb59f0dcddf12882a0e0132fbd6c2c94dacc67e1fadd62\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@arm64_darwin",
"product": {
"name": "trillian-cli-stack-v1-4@arm64_darwin",
"product_id": "trillian-cli-stack-v1-4@arm64_darwin",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_darwin_arm64.tar.gz\u0026checksum=sha256%3A147842ba7f5d7d777a9a17a93ec11a06439f0c8fa3aa3bb93e7905e7bb5378b1\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "arm64_darwin"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64",
"product": {
"name": "conforma-cli-stack-v1-4@amd64",
"product_id": "conforma-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_amd64.tar.gz\u0026checksum=sha256%3Afe850ff78ccd6a2536761252abe869b12e8555099b903088fb77415db810faeb\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64",
"product": {
"name": "cosign-cli-stack-v1-4@amd64",
"product_id": "cosign-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_amd64.tar.gz\u0026checksum=sha256%3Ab5ad8965d128b0362f978262a8cec0b97e5b8a017cc9f3bdf792d481f39cdca9\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_amd64.tar.gz\u0026checksum=sha256%3A7bcaae762c0ae4bc631e055469984b58a6a3f63178919c783c64b04800054d3c\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64",
"product_id": "gitsign-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_amd64.tar.gz\u0026checksum=sha256%3A092ff1a20e6b3a586c45f15322c234c509c907013a6d281e61b37dbdf8d08da6\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64",
"product_id": "model-transparency-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_amd64.tar.gz\u0026checksum=sha256%3A644c135df58d8349afd7ef6161939a6e32d0378fe3ddd79e8ebc2e6e121c0a7c\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64",
"product": {
"name": "rekor-cli-stack-v1-4@amd64",
"product_id": "rekor-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_amd64.tar.gz\u0026checksum=sha256%3Ac2cd95304bf21ddb404f75d2752edd9b0ac1dcacb5d00bc33e9a1e50a60b8263\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64",
"product": {
"name": "trillian-cli-stack-v1-4@amd64",
"product_id": "trillian-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_amd64.tar.gz\u0026checksum=sha256%3A8e7969ad725e923cd4b5106cd9c001274b2f599c147f94ab88c7983e77779518\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "tuftool-cli-stack-v1-4@amd64",
"product": {
"name": "tuftool-cli-stack-v1-4@amd64",
"product_id": "tuftool-cli-stack-v1-4@amd64",
"product_identification_helper": {
"purl": "pkg:generic/tuftool-cli-stack-v1-4@1.4.3?filename=tuftool_linux_amd64.tar.gz\u0026checksum=sha256%3A99bac870e85db0b22ed0881c93e811cf70eed102b47d41a3a3c1cae7e0da6f24\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@arm64",
"product": {
"name": "conforma-cli-stack-v1-4@arm64",
"product_id": "conforma-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_arm64.tar.gz\u0026checksum=sha256%3A23de179f43a4145d1b9fa681e0f15b681d7a5bc3f2a5d4237db305b7ecde4f75\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@arm64",
"product": {
"name": "cosign-cli-stack-v1-4@arm64",
"product_id": "cosign-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_arm64.tar.gz\u0026checksum=sha256%3A92016ad84dd2cc43e8cd4d4a12dc5c09f9c5917d72058d4a8ec4b80f57721552\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_arm64.tar.gz\u0026checksum=sha256%3Aacf168c048297dd0845a9258ff05122b5ac04133983ec12185889fa4e24c949e\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@arm64",
"product": {
"name": "gitsign-cli-stack-v1-4@arm64",
"product_id": "gitsign-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_arm64.tar.gz\u0026checksum=sha256%3Af1d2cd7760f778bdde8a93fce683b01a5d35b75a5e70244ef54706be23d64e88\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@arm64",
"product": {
"name": "model-transparency-cli-stack-v1-4@arm64",
"product_id": "model-transparency-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_arm64.tar.gz\u0026checksum=sha256%3A153247e5c490219a2d2c64b1dd109c273d31b08fec64e499b0da6d81d5a426b2\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@arm64",
"product": {
"name": "rekor-cli-stack-v1-4@arm64",
"product_id": "rekor-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_arm64.tar.gz\u0026checksum=sha256%3Aff0c33eb7f4e82f523a1f84591f42b58319f146cdf486e5f303cc1d7d102d139\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@arm64",
"product": {
"name": "trillian-cli-stack-v1-4@arm64",
"product_id": "trillian-cli-stack-v1-4@arm64",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_arm64.tar.gz\u0026checksum=sha256%3Ab272964a73e058251845e12b2bc07f4398d391a7a642e4d3fdf003d7e3651d0a\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@ppc64le",
"product": {
"name": "conforma-cli-stack-v1-4@ppc64le",
"product_id": "conforma-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_ppc64le.tar.gz\u0026checksum=sha256%3A43c5e32c8b05224fcdb8fd4e02fc95a0c45c697ce02fe845cbc6c0b65011914b\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@ppc64le",
"product": {
"name": "cosign-cli-stack-v1-4@ppc64le",
"product_id": "cosign-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_ppc64le.tar.gz\u0026checksum=sha256%3Ace54373736d56eeb9fd9196e4e8d154a19e0c1be4f79a7e49c45189204b8be8c\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_ppc64le.tar.gz\u0026checksum=sha256%3A3d26686ce8a19183d0c1594d9fba01502db3d5bbf314f03220045546ebff21b9\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@ppc64le",
"product": {
"name": "gitsign-cli-stack-v1-4@ppc64le",
"product_id": "gitsign-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_ppc64le.tar.gz\u0026checksum=sha256%3Ab36b2473abf86da8d1946d7f1cfc98fc915c824e674134150da42fe2c909cb40\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@ppc64le",
"product": {
"name": "model-transparency-cli-stack-v1-4@ppc64le",
"product_id": "model-transparency-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_ppc64le.tar.gz\u0026checksum=sha256%3Ac6a6924aadf33d43839b09a41cc99c6552add5cca758c30de2715c4c2d39c7c6\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@ppc64le",
"product": {
"name": "rekor-cli-stack-v1-4@ppc64le",
"product_id": "rekor-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_ppc64le.tar.gz\u0026checksum=sha256%3Abcc90bfef837fe04e832ba21034aaba9419e72458899dd7929ef117c739d83ba\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@ppc64le",
"product": {
"name": "trillian-cli-stack-v1-4@ppc64le",
"product_id": "trillian-cli-stack-v1-4@ppc64le",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_ppc64le.tar.gz\u0026checksum=sha256%3Af54b20dafe80d52dbd0b2ac9feeef7dd469312b8e5a430669627bb7b22757f9a\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@s390x",
"product": {
"name": "conforma-cli-stack-v1-4@s390x",
"product_id": "conforma-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_linux_s390x.tar.gz\u0026checksum=sha256%3A899d90fa1e4004deecfd748edc9bc08a11b81f0e1918248288d783c0779dfaa1\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@s390x",
"product": {
"name": "cosign-cli-stack-v1-4@s390x",
"product_id": "cosign-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_linux_s390x.tar.gz\u0026checksum=sha256%3Abda606880c51943c4d359dfb0dab673f5054ea3cfbe0bf7f60c080992ccba6cb\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_linux_s390x.tar.gz\u0026checksum=sha256%3A3fc5432f460b74b4c9fd34bc8ee53dcbe75f21cd507f604a97245e5a6099eeec\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@s390x",
"product": {
"name": "gitsign-cli-stack-v1-4@s390x",
"product_id": "gitsign-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_linux_s390x.tar.gz\u0026checksum=sha256%3Ace7d0514a83e7c3de696c2c7530a102f43ab81443c96c335e0c9b717aae704f6\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@s390x",
"product": {
"name": "model-transparency-cli-stack-v1-4@s390x",
"product_id": "model-transparency-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_linux_s390x.tar.gz\u0026checksum=sha256%3Afe19f79e90f4d3f73d37b8cd51bba6574c9e365b8dc147bdd92f2623cf223053\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@s390x",
"product": {
"name": "rekor-cli-stack-v1-4@s390x",
"product_id": "rekor-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_linux_s390x.tar.gz\u0026checksum=sha256%3A293ed031b6a8265b30dea4c61ea793b98f783c1f5919bba9d89e0807df181dce\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@s390x",
"product": {
"name": "trillian-cli-stack-v1-4@s390x",
"product_id": "trillian-cli-stack-v1-4@s390x",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_linux_s390x.tar.gz\u0026checksum=sha256%3Ad14b422dd794265f466b50df38052d6b65ccc44758d6970b8aaf63def82a5238\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "conforma-cli-stack-v1-4@amd64_windows",
"product": {
"name": "conforma-cli-stack-v1-4@amd64_windows",
"product_id": "conforma-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/conforma-cli-stack-v1-4@1.4.3?filename=ec_windows_amd64.zip\u0026checksum=sha256%3A31be5f7fd0a135f1251ba47c3772dd2d3804b568bee4ddb644284d1a5ba46e54\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "cosign-cli-stack-v1-4@amd64_windows",
"product": {
"name": "cosign-cli-stack-v1-4@amd64_windows",
"product_id": "cosign-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/cosign-cli-stack-v1-4@1.4.3?filename=cosign_windows_amd64.zip\u0026checksum=sha256%3A988f094e519e8e6f6f19d73e132a4d78e85d552d6c18ed93eb387284e02bb91c\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product_id": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/fetch-tsa-certs-cli-stack-v1-4@1.4.3?filename=fetch_tsa_certs_windows_amd64.zip\u0026checksum=sha256%3A8144083b1b7cda5bf4c4514f695298dd9db8337f012eceb50ad55791a5aca14f\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "gitsign-cli-stack-v1-4@amd64_windows",
"product": {
"name": "gitsign-cli-stack-v1-4@amd64_windows",
"product_id": "gitsign-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/gitsign-cli-stack-v1-4@1.4.3?filename=gitsign_cli_windows_amd64.zip\u0026checksum=sha256%3Ac5caaa0e3d970b115e8882ca559a3c646876b1b8715d2b1595893069d148a975\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "model-transparency-cli-stack-v1-4@amd64_windows",
"product": {
"name": "model-transparency-cli-stack-v1-4@amd64_windows",
"product_id": "model-transparency-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/model-transparency-cli-stack-v1-4@1.4.3?filename=model_transparency_cli_windows_amd64.exe.gz\u0026checksum=sha256%3Ae3069473632f310db5789c9aa163357be419fd63e9207ce172eb4983ad238ce8\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "rekor-cli-stack-v1-4@amd64_windows",
"product": {
"name": "rekor-cli-stack-v1-4@amd64_windows",
"product_id": "rekor-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/rekor-cli-stack-v1-4@1.4.3?filename=rekor_cli_windows_amd64.zip\u0026checksum=sha256%3Aa693c0e3c59eb810900e3108f5917c6811040dfea4dbe7546dabadc77308d023\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
},
{
"category": "product_version",
"name": "trillian-cli-stack-v1-4@amd64_windows",
"product": {
"name": "trillian-cli-stack-v1-4@amd64_windows",
"product_id": "trillian-cli-stack-v1-4@amd64_windows",
"product_identification_helper": {
"purl": "pkg:generic/trillian-cli-stack-v1-4@1.4.3?filename=createtree_windows_amd64.zip\u0026checksum=sha256%3Ab12859b13938626a1139a4afc3b202a80ece5ffd72c51da782f7e0516733dd6c\u0026download_url=https%3A%2F%2Fdevelopers.redhat.com%2Fproducts"
}
}
}
],
"category": "architecture",
"name": "amd64_windows"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64"
},
"product_reference": "conforma-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "conforma-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows"
},
"product_reference": "conforma-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64"
},
"product_reference": "conforma-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "conforma-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le"
},
"product_reference": "conforma-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "conforma-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
},
"product_reference": "conforma-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64"
},
"product_reference": "cosign-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "cosign-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows"
},
"product_reference": "cosign-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64"
},
"product_reference": "cosign-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "cosign-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le"
},
"product_reference": "cosign-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x"
},
"product_reference": "cosign-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "fetch-tsa-certs-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x"
},
"product_reference": "fetch-tsa-certs-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows"
},
"product_reference": "gitsign-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64"
},
"product_reference": "gitsign-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "gitsign-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le"
},
"product_reference": "gitsign-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gitsign-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x"
},
"product_reference": "gitsign-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows"
},
"product_reference": "model-transparency-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64"
},
"product_reference": "model-transparency-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "model-transparency-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le"
},
"product_reference": "model-transparency-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "model-transparency-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x"
},
"product_reference": "model-transparency-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64"
},
"product_reference": "rekor-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "rekor-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows"
},
"product_reference": "rekor-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64"
},
"product_reference": "rekor-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "rekor-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le"
},
"product_reference": "rekor-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rekor-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x"
},
"product_reference": "rekor-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64"
},
"product_reference": "trillian-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin"
},
"product_reference": "trillian-cli-stack-v1-4@amd64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows"
},
"product_reference": "trillian-cli-stack-v1-4@amd64_windows",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64"
},
"product_reference": "trillian-cli-stack-v1-4@arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin"
},
"product_reference": "trillian-cli-stack-v1-4@arm64_darwin",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le"
},
"product_reference": "trillian-cli-stack-v1-4@ppc64le",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trillian-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x"
},
"product_reference": "trillian-cli-stack-v1-4@s390x",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tuftool-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
},
"product_reference": "tuftool-cli-stack-v1-4@amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39833",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-05-22T04:01:35.714593+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480683"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this issue as Moderate with RH CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). A flaw was found in golang.org/x/crypto/ssh/agent where the in-memory keyring returned by NewKeyring() silently accepted SSH agent keys with the ConfirmBeforeUse constraint but did not enforce interactive confirmation before signing. Exploitation requires local access and low privileges on a system where an affected application uses NewKeyring() with ConfirmBeforeUse. Most Red Hat products that bundle golang.org/x/crypto do not use the ssh/agent ConfirmBeforeUse feature in their supported execution paths. The upstream CISA CVSS 9.1 assumes a broader network attack context that does not reflect Red Hat product deployment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "RHBZ#2480683",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480683"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833"
},
{
"category": "external",
"summary": "https://go.dev/cl/778640",
"url": "https://go.dev/cl/778640"
},
{
"category": "external",
"summary": "https://go.dev/cl/778641",
"url": "https://go.dev/cl/778641"
},
{
"category": "external",
"summary": "https://go.dev/issue/79436",
"url": "https://go.dev/issue/79436"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5005",
"url": "https://pkg.go.dev/vuln/GO-2026-5005"
}
],
"release_date": "2026-05-22T02:31:26.294000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"known_not_affected": [
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T18:08:33+00:00",
"details": "The RHTAS CLI Stack images contain Red Hat Trusted Artifact Signer CLI binaries.\n\nFor details on using the CLI images, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:conforma-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:cosign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:fetch-tsa-certs-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:gitsign-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:model-transparency-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:rekor-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@amd64_windows",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@arm64_darwin",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@ppc64le",
"Red Hat Trusted Artifact Signer 1.4:trillian-cli-stack-v1-4@s390x",
"Red Hat Trusted Artifact Signer 1.4:tuftool-cli-stack-v1-4@amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
}
]
}
RHSA-2026:51033
Vulnerability from csaf_redhat - Published: 2026-08-06 07:31 - Updated: 2026-08-22 21:41Summary
Red Hat Security Advisory: Red Hat OpenShift API for Data Protection
Severity
Important
Notes
Topic: A new version of OpenShift API for Data Protection (OADP) is now available.
Details: OpenShift API for Data Protection (OADP) enables you to back up and restore
application resources, persistent volume data, and internal container
images to external backup storage. OADP enables both file system-based and
snapshot-based backups for persistent volumes.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A local privilege escalation vulnerability has been discovered in containerd. This vulnerability is the result of an overly broad default permission which allows local users on the host to potentially access the metadata store, the content store and the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
7.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
29 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Threats
Impact
Important
A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service (DoS) due to excessive memory allocation when processing a malicious OpenID Connect (OIDC) identity token containing numerous period characters.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Vendor Fix
fix
|
Known not affected
37 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Threats
Impact
Important
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.
8.1 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.
7.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Threats
Impact
Important
A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x | — |
Threats
Impact
Important
References
257 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of OpenShift API for Data Protection (OADP) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift API for Data Protection (OADP) enables you to back up and restore\napplication resources, persistent volume data, and internal container\nimages to external backup storage. OADP enables both file system-based and\nsnapshot-based backups for persistent volumes.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:51033",
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-25621",
"url": "https://access.redhat.com/security/cve/CVE-2024-25621"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61729",
"url": "https://access.redhat.com/security/cve/CVE-2025-61729"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-66506",
"url": "https://access.redhat.com/security/cve/CVE-2025-66506"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33747",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33748",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39831",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42306",
"url": "https://access.redhat.com/security/cve/CVE-2026-42306"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44740",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53488",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53492",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51033.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift API for Data Protection",
"tracking": {
"current_release_date": "2026-08-22T21:41:56+00:00",
"generator": {
"date": "2026-08-22T21:41:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:51033",
"initial_release_date": "2026-08-06T07:31:01+00:00",
"revision_history": [
{
"date": "2026-08-06T07:31:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-22T21:41:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift API for Data Protection 1.3",
"product": {
"name": "OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_api_data_protection:1.3::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift API for Data Protection"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1785180801"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1785177413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1785177359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1785426166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"product_id": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-operator-bundle@sha256%3Abf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-operator-bundle\u0026tag=1785427055"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1785180878"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1785177357"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3Ab26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1785177325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-csi-rhel9@sha256%3Ae23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9\u0026tag=1785177350"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Afd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1785426129"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1785177322"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3A36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1785177438"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1785180801"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1785177413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1785177359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1785426166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1785180878"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1785177357"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1785177325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-csi-rhel9@sha256%3A9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9\u0026tag=1785177350"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1785426129"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1785177322"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3Abe6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1785177438"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1785180801"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1785177413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3Acc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1785177359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3Ab38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1785426166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1785180878"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1785177357"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1785177325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-csi-rhel9@sha256%3A345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9\u0026tag=1785177350"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Afa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1785426129"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1785177322"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3A378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1785177438"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1785180801"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Acf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1785177413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3Aeea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1785177359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3Ac2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1785426166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1785180878"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3Ac612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1785177357"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1785177325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-csi-rhel9@sha256%3A46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9\u0026tag=1785177350"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1785426129"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3Abd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1785177322"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3Aaebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1785177438"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64 as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x as a component of OpenShift API for Data Protection 1.3",
"product_id": "OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-25621",
"cwe": {
"id": "CWE-279",
"name": "Incorrect Execution-Assigned Permissions"
},
"discovery_date": "2025-11-06T19:01:04.402278+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413190"
}
],
"notes": [
{
"category": "description",
"text": "A local privilege escalation vulnerability has been discovered in containerd. This vulnerability is the result of an overly broad default permission which allows local users on the host to potentially access the metadata store, the content store and the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd local privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-25621"
},
{
"category": "external",
"summary": "RHBZ#2413190",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413190"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-25621",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25621"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-25621",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25621"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/blob/main/docs/rootless.md",
"url": "https://github.com/containerd/containerd/blob/main/docs/rootless.md"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5",
"url": "https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w"
}
],
"release_date": "2025-11-06T18:36:21.566000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "The system administrator on the host can manually chmod the directories to not\nhave group or world accessible permissions:\n```\nchmod 700 /var/lib/containerd\nchmod 700 /run/containerd/io.containerd.grpc.v1.cri\nchmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim\n```\nAn alternative mitigation would be to run containerd in rootless mode.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd local privilege escalation"
},
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:39.965024+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434431"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "RHBZ#2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://go.dev/cl/736713",
"url": "https://go.dev/cl/736713"
},
{
"category": "external",
"summary": "https://go.dev/issue/77102",
"url": "https://go.dev/issue/77102"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4342",
"url": "https://pkg.go.dev/vuln/GO-2026-4342"
}
],
"release_date": "2026-01-28T19:30:31.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
},
{
"cve": "CVE-2025-61729",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2025-12-02T20:01:45.330964+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418462"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61729"
},
{
"category": "external",
"summary": "RHBZ#2418462",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
},
{
"category": "external",
"summary": "https://go.dev/cl/725920",
"url": "https://go.dev/cl/725920"
},
{
"category": "external",
"summary": "https://go.dev/issue/76445",
"url": "https://go.dev/issue/76445"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4155",
"url": "https://pkg.go.dev/vuln/GO-2025-4155"
}
],
"release_date": "2025-12-02T18:54:10.166000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
},
{
"cve": "CVE-2025-66506",
"cwe": {
"id": "CWE-405",
"name": "Asymmetric Resource Consumption (Amplification)"
},
"discovery_date": "2025-12-04T23:01:20.507333+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2419056"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service (DoS) due to excessive memory allocation when processing a malicious OpenID Connect (OIDC) identity token containing numerous period characters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat as Fulcio, a certificate authority used for issuing code signing certificates, is susceptible to a denial of service when processing a specially crafted OpenID Connect (OIDC) token. This could lead to resource exhaustion and service unavailability in affected Red Hat products that utilize Fulcio.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66506"
},
{
"category": "external",
"summary": "RHBZ#2419056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66506",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66506"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66506",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66506"
},
{
"category": "external",
"summary": "https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a",
"url": "https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"
},
{
"category": "external",
"summary": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw",
"url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw"
}
],
"release_date": "2025-12-04T22:04:41.637000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33747",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T02:01:29.921765+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452076"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "RHBZ#2452076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj"
}
],
"release_date": "2026-03-27T00:49:06.165000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend"
},
{
"cve": "CVE-2026-33748",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T15:02:00.107493+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452271"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "RHBZ#2452271",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452271"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33748"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://docs.docker.com/build/concepts/context/#url-fragments",
"url": "https://docs.docker.com/build/concepts/context/#url-fragments"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg"
}
],
"release_date": "2026-03-27T14:00:21.200000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39831",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-22T04:01:12.861178+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "RHBZ#2480675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://go.dev/cl/781662",
"url": "https://go.dev/cl/781662"
},
{
"category": "external",
"summary": "https://go.dev/issue/79566",
"url": "https://go.dev/issue/79566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5019",
"url": "https://pkg.go.dev/vuln/GO-2026-5019"
}
],
"release_date": "2026-05-22T02:31:27.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42306",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-06-12T19:01:10.843543+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488484"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Moby container framework where a race condition during `docker cp` mount setup could allow a malicious container to overwrite arbitrary host files. Exploitation requires an attacker to have control over a running container, which could lead to data corruption or denial of service on the host system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42306"
},
{
"category": "external",
"summary": "RHBZ#2488484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42306"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42306",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42306"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh",
"url": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"
}
],
"release_date": "2026-06-12T18:09:22.188000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-44740",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-01T17:01:53.685793+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483894"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "RHBZ#2483894",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44740",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44740"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
"url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
"url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
"url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
}
],
"release_date": "2026-06-01T16:04:50.358000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
},
{
"cve": "CVE-2026-53488",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-07-01T02:01:09.589815+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in containerd where the CRI plugin propagates labels from an image configuration (LABEL instruction in a Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host via a plugin that consumes container labels for operations, such as the restart-monitor binary:// logger. An attacker who can cause a crafted container image to be pulled and run can achieve host-level code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "RHBZ#2495815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"
}
],
"release_date": "2026-07-01T00:11:20.610000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "workaround",
"details": "Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin"
},
{
"cve": "CVE-2026-53492",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-01T19:01:34.238078+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496130"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. In Red Hat OpenShift Container Platform, a user with pod creation permissions could bypass standard Kubernetes resource allocation and device plugin enforcement. This is due to containerd\u0027s Container Runtime Interface (CRI) improperly trusting Container Device Interface (CDI) annotations during container restoration. Exploitation requires CDI to be enabled on the node and a matching host CDI specification for the requested device.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "RHBZ#2496130",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496130"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"
}
],
"release_date": "2026-07-01T17:59:12.552000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T07:31:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:48a9021e3e559028b47eb049452df977177c93093d59131098ac0b6b10026213_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:56a93ad53df1c0445b3fee293ab42caa375f88b72872d8fb844efeb114869eaa_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:93fa051884d7ca638e8aee7244dc1635e1b1d07d05d7e7098fee24aae642afb4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4d763201b2daa4fe2e7f74fb42671e9752b9c301272b357d9e810420a617aff2_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:4f2300a741dd4e84bf99b1ff738a00fddd52b75db4b69ad42f3faf47e8ae3e75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:956de2cb9012bb5d0cc0eee438e58dab3090f445617aa4f3361dbe7f9f151eb0_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf80473217c222c4e5cc7451f5a256422b553e01df03113b758e4172c3a3b5f3_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:93d8ce09a06af1c287ebe7616ebc38f6cf0acb52e11f96dbfbcca583c5e0540f_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:9ef46cc9fe1bb0608aba0b4d72bb1a1479e93e96f8cae8eea01643689fa568c5_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:cc86577f50b381f29b2a065527f227f5968be315908fc1683c89d52bafdf8f60_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:eea354fd6baee1b98e209e06863a04975885a3c12be678f3e33bcdd077549030_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-operator-bundle@sha256:bf818a9af2dc1e22b2c24d07d8e52f65453b529076277fb3eb26069aa4ad3484_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:54db3ee0284dbebea5017981abb6f7c710d7f1c505389931290d39a926cc805e_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5c0f39a8d788109cf25cee0fa5d0f62024303a7f396b011ea257a4d89ba062cb_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:b38f0ae8f13ad9f9c8088d46b1e38b1348976dbfae03338cacf84c9f3ff7d6a3_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c2ad30f62435ccf5250dab6e6e8286ca733cd513c8ab98b9d59ae3f20f606d10_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1f2aa602270f1997e13f242fc75c52356de0c24ba68640b042e5d16280901e44_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2e742bb7f42f63c253d8c027783f4722e5c140ca9f2fe9872cb874c2886535b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:4c20843755e2706f863274be9159a5e8e07895af8f70518b95bff5daf441e78e_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b26b7bc0844ba584035ede98486feead55b5066667e068d05fcbeb6cc971b0e6_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:345f3aa4c15440f3a49513a2f49631799a0d9dda8ff1f3cd114adbc1e9d996c5_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:46227e86cc58f7b19655017b313bc8bcdd38f1f78d4f52f4a68428dfc54e3dfc_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:9e2cde3376ceec8f2794102f2b9834298eda10c9f7fe947c56f684fd493d8a75_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9@sha256:e23a3ed44476b29116abc947f84e0134800ac5a3a97a4d7b6338d02a77940552_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:19b74fe19c3e183f37af9f8db97eb7ab858c46c6c5bf6c10154f622948dd327b_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:43f70e447a16f13fb6f54c3b5b924ca475be3aa6e5af8cc5445728488e2d6025_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fa94619dec5548247a1b304e060094e07878276a6ee1351010d0a4cae5023af1_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:fd943aa4cdb7f56dd2b3a5ed30d4ba635e2c238e4cb5e8577671d301ef3129ab_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:39fc14634b12f9fe479aaf5158d3045fc12df6f5b5b9abb9dbe041b49ac2e330_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:40f8b07eaceb45648f8d8c3c05aea3ea297c7a6ad3fa03d5d584a9794a1e37b2_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:7ec0bb0c482b26eacd316064ab574b4e3222c738bb6fd93c7cdb256a78e9914e_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:bd3c7d05d5fbf4ee07809b5698c80a1a0d36b6f3742210239615221603e3fcb2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:67a46a2e5009d48b84a206a8a6c6ef240356f2eb45aa035e660875601d34f4e4_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:6d17bf782abba341a8c1ffe638a498cd6c6e71c2791633d4b01b516702fdadaf_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:7498539ff18032e50df1c8641d1aa0993b0068276fd4770140d844b22dd020b7_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:c612178391540c6f2f29281b01c6bb3abc6c659872b9a8652e599c8f4ee4bfa2_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:36c85ae99ee17573a3e851cf1b3a60c5c75be3789d3ab2ddcfd9faf89b45a352_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:378da075a87da97c186d6b069ceba23b8ce50b8fc183f89bc6775c9a0c93d92c_s390x",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aebba180f2693a7833fd76168a9eb7b532e026e40076003ceb0a3a9d98e9bc70_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:be6ee9a26cfbc7420c83970f228c1d5fa90cf78ea6c4026e71e2fd0222db8207_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:391767c3af8ae4acb6d1b0fa94e194def61452ba95e3a1e6cd73ef725cf651ca_ppc64le",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:4de257f9bcb8361aeaad6ff569de2c489b2cb2b5cf03eecd5a4f203bea589cc0_amd64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9677eab53d4c0ef23c5e4b62f4a308990f3f14aac9be3b97297861ef7517a296_arm64",
"OpenShift API for Data Protection 1.3:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:9e6cbcb72af1a9b2b3843d69e5fabcc967acb7ad55c377c1c011b2214aacc3c5_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration."
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…